Deployment Architecture

In clustered env, How SH know which indexer is holding the primary bucket or searchable bucket of an index?

poornam
Explorer

In a cluster environment (50+ nodes), how the search head aware of which indexer(s) (search peer) to connect for searchable buckets of an index?

Will cluster master distribute the state of index and indexer to all its clients (SH)? What will if clust master goes down for a day, in this case?

0 Karma
1 Solution

poornam
Explorer

@Skalli, the question is not about what will happen when the master goes down.

The question is, how the search head aware of which indexer(s) (search peer) to connect for searchable buckets of an index, irrespective of cluster master availablity?

View solution in original post

0 Karma

poornam
Explorer

@Skalli, the question is not about what will happen when the master goes down.

The question is, how the search head aware of which indexer(s) (search peer) to connect for searchable buckets of an index, irrespective of cluster master availablity?

0 Karma

skalliger
Motivator

Read the article. A SH sends its searches to all of the indexers in a cluster. The one with the data sends the data back. Basically, the cluster continues to work like it did when the master was last available.

0 Karma

poornam
Explorer

Thanks for lead.

The below article gave clear details about distributed search and generation id.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/Bucketsandclusters.

0 Karma

skalliger
Motivator

This question and kind of similar questions have beend asked quite a lot.
The cluster will continue to work as long as no other peers are going down, to give you a short answer.

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Whathappenswhenamasternodegoesdown

Skalli

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...