Deployment Architecture

In a clustered deployment, can you reference the master node by a DNS name instead of an IP?

kdoonan
Explorer

Eg, if you specify the master as master.domain.local? This may be a silly question but will it cause any issues? The idea being that if the master goes down, we can relaunch it and just change the DNS to point to the new server.

Some follow on questions:

If we do this and change the DNS, will the nodes resolve the change automatically?

If there are 2 master servers running, but only 1 of them is being sent data, will it cause any issues? Eg, if we do relaunch the server and then the original one recovers.

Thanks

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I see no reason not to use a DNS name. http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Handlemasternodefailure#Ensure_that_the_pe... explicitly mentions using DNS as well.

As for the old master coming back up, your nodes won't notice because you've changed the DNS entry.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I see no reason not to use a DNS name. http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Handlemasternodefailure#Ensure_that_the_pe... explicitly mentions using DNS as well.

As for the old master coming back up, your nodes won't notice because you've changed the DNS entry.

Get Updates on the Splunk Community!

What's New in Splunk Observability - October 2025

What’s New?  We’re excited to announce the latest enhancements to Splunk Observability Cloud and share what’s ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened Audit Trail v2 wasn’t written in isolation—it was shaped by your voices. In ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...