Deployment Architecture

Can the indexer cluster master itself decide to be a search head?

shahk
Explorer

Hello Team,

I am very curious to know the answer of this question.

I have an index clustering setup consisting of one license manager, two index peer nodes, and one index master node.

I never defined any of the nodes as a search head node. However, when I click on search head tab under settings --> Index Clustering in index master Splunk Web UI, it show me the master indexer node host name, even though I never defined indexer master node as a search head node.

Can anyone explain me how does it show index master node as search head node also?

Regards,K
Krimesh

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

The indexer cluster requires a dedicated search head. See http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Systemrequirements#Required_Splunk_Enterpr...

The master node does have search head capabilities, but they can only be used for debugging purposes. See http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Systemrequirements#Additional_roles_for_th...

skoelpin
SplunkTrust
SplunkTrust

All nodes will default as a search head

The basic configuration of the search head node occurs during initial deployment of the indexer cluster. You can edit the configuration later.

http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Configurethesearchhead

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...