Merge Indexer Cluster and Search Head Cluster after a Split Brain


How can a search head and an indexer cluster be merged after the cluster has been run intentionally in a split brain setup for some time.

e.g. the connections between two locations of a multi site cluster is broken and a captain has been assigned manualy to the second site.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Hi Fritz

The scenario is well documented on the following Splunk docs:

Handle master site failure:

Restart indexing in multisite cluster after master restart or site failure

Ensure that the peer and search head nodes can find the new master

Happy Splunking!

0 Karma