How to enable clustering ?

[_Raj]

Hi,

Please guide me how  to enable clustering (splunk enable cluster-master, splunk edit cluster-config) for one instance as Cluster Master, 3 instances as Indexers, 3 instances as Search Heads.

Thanks

[vjdev]

Hello,

+++++++++++++
Indexer Cluster +
+++++++++++++

Via GUI
========

cluster-manager
--------------

Settings -> Indexer Clustering -> Enable indexer clustering -> Manager node ->

Replication Factor : 2
Search Factor : 2
Security Key :passkey123
Cluster Label : Cluster1

Click -> Enable Manger Node

Peer Node
----------

Settings -> Indexer Clustering -> Enable indexer clustering -> Peer node

Manager URI : https://managerip:8089 [Cluster manager]
Peer replication port : 8080
Security key : passkey123

Click -> Enable Peer Node

Search head node
----------------
Settings -> Indexer Clustering -> Enable indexer clustering -> Search head node

Manager URI : https://managerip:8089
Security key : passkey123

Click -> Enable Search head Node

Via Config File:
========

Manager:
--------

server.conf

[clustering]
mode = manager
replication_factor = 2
search_factor = 2
pass4SymmKey = passkey123
cluster_label = cluster1

Peer Node:
----------

server.conf

[replication_port://8080]

[clustering]
manager_uri = https://managerip:8089
mode = peer
pass4SymmKey = passkey123

Search Head:
------------

[clustering]
manager_uri = https://managerip:8089
mode = searchhead
pass4SymmKey = passkey123

Via Cli
=======

Manager Node:
--------------
./splunk edit cluster-config -mode manager -replication_factor 2 -search_factor 2 -secret passkey123 -cluster_label cluster1

./splunk restart

Peer Node:
----------

./splunk edit cluster-config -mode peer -manager_uri https://managerip:8089 -replication_port 8080 -secret passkey123

./splunk restart

Search Head:
------------

./splunk edit cluster-config -mode searchhead -manager_uri https://managerip:8089 -secret passkey123

./splunk restart

./splunk show cluster-status

+++++++++++++++++++++++++++++++++++++++++

++++++++++++++++++
Searh Head Cluster
++++++++++++++++++

Deployer
------------

server.conf

[shclustering]
pass4SymmKey = yoursecuritykey
shcluster_label = shcluster1

SH
---

/opt/splunk/bin/splunk init shcluster-config -auth admin:changed -mgmt_uri https://sh1.example.com:8089 -replication_port 8887 -replication_factor 2 -conf_deploy_fetch_url https://deployerip:8089 -secret yoursecuritykey -shcluster_label shcluster1

[Repeat On all SH only by changing mgmt_uri]

Once done in All SH. Choose captain.

/opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list "https://sh1.example.com:8089,https://sh2.example.com:8089,https://sh3.example.com:8089,https://sh4.e..." -auth admin:changed

Check Status

/opt/splunk/bin/splunk show shcluster-status

Thank You!

[thahir]

Hi @_Raj ,

you can refer the below steps to enable the clustering part

Pre-requisites

-> Ensure all Splunk instances have compatible versions.
-> Network connectivity and required firewall ports between all instances must be open.
-> Have a look on the License part as well

Configure Cluster Manager (Master Node)

1. On the instance to be Cluster Master, run these commands under $SPLUNKHOME path usually /opt/splunk/bin

splunk edit cluster-config -mode master -replication_factor <number> -search_factor <number> -secret <your_security_key> -cluster_label <your_cluster_name>

2. Restart the Splunk

Configure Indexer Cluster Members (3 Indexers)

1.Enable indexer clustering and set the master URI and secret:

splunk edit cluster-config -mode peer -master_uri <uri_of_cluster_master>:<management_port> -replication_port <replication_port> -secret <security_key>

2. Then Splunk restart and validate the Splunkd logs

ref: https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/9.4/con...  

Configure Search Head Cluster (3 Search Heads)

-> On one Search Head, enable search head clustering and bootstrap the cluster, execute the below command on the Splunk bin path

splunk init shcluster-config -auth <username>:<password> -mgmt_uri <URI>:<management_port> -replication_port <replication_port> -replication_factor <n> -conf_deploy_fetch_url <URL>:<management_port> -secret <security_key> -shcluster_label <label>

repeat for the other two nodes

splunk restart

Run the splunk bootstrap shcluster-captain command on the selected instance:

splunk bootstrap shcluster-captain -servers_list "<URI>:<management_port>,<URI>:<management_port>,..." -auth <username>:<password>

Ref: https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/deploy-search-head-cl... 

[_Raj]

@thahir 

How to do this in UI mode is there option ?

[richgalloway]

There is no GUI for setting up Splunk clusters.  You must use the CLI.

[gcusello]

Hi @_Raj ,

see these:

https://www.youtube.com/watch?v=ZiNCRsUE7LQ

https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.0/ov...

https://docs.splunk.com/Documentation/Splunk/9.3.1/Indexer/Clusterdeploymentoverview

https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/overview-of-search-he...

https://www.youtube.com/watch?v=VPa3EjqD8Q4

https://www.youtube.com/watch?v=3JjLtoRDXOE

Ciao.

Giuseppe