Deployment Architecture

GUID of a search-head cluster

PickleRick
SplunkTrust
SplunkTrust

I'm reading the docs about sharing summaries between search-heads and I'm a bit puzzled.

https://docs.splunk.com/Documentation/Splunk/8.2.1/Knowledge/Sharedatamodelsummaries

The article states: "You can find the GUID for a search head cluster in the [shclustering] stanza of server.conf. If you are running a single instance you can find the GUID in etc/instance.cfg. "

 But in my case the only guids I can find are those on single shcluster members in etc/instance.cfg. Of course each one is different. I cannot seem to find a "search head cluster GUID" anywhere.

What am I doing wrong?

Labels (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

In Search Head Cluster, you can find GUID in $SPLUNK_HOME/etc/system/local/server.conf under [shclustering] stanza and parameter name is id

id = <GUID>
* Unique identifier for this cluster as a whole, shared across all cluster
  members.
* Default: Splunk software arranges for a unique value to be generated and
  shared across all members.

 

View solution in original post

harsmarvania57
Ultra Champion

Hi,

In Search Head Cluster, you can find GUID in $SPLUNK_HOME/etc/system/local/server.conf under [shclustering] stanza and parameter name is id

id = <GUID>
* Unique identifier for this cluster as a whole, shared across all cluster
  members.
* Default: Splunk software arranges for a unique value to be generated and
  shared across all members.

 

PickleRick
SplunkTrust
SplunkTrust

Argh. I was looking for a guid parameter, not id. That's why I couldn't find it.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...