In clustered env, How SH know which indexer is holding the primary bucket or searchable bucket of an index?

[poornam]

In a cluster environment (50+ nodes), how the search head aware of which indexer(s) (search peer) to connect for searchable buckets of an index?

Will cluster master distribute the state of index and indexer to all its clients (SH)? What will if clust master goes down for a day, in this case?

[poornam · Accepted solution]

@Skalli, the question is not about what will happen when the master goes down.

The question is, how the search head aware of which indexer(s) (search peer) to connect for searchable buckets of an index, irrespective of cluster master availablity?

[skalliger]

Read the article. A SH sends its searches to all of the indexers in a cluster. The one with the data sends the data back. Basically, the cluster continues to work like it did when the master was last available.

[poornam]

Thanks for lead.

The below article gave clear details about distributed search and generation id.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/Bucketsandclusters.

[skalliger]

This question and kind of similar questions have beend asked quite a lot.
The cluster will continue to work as long as no other peers are going down, to give you a short answer.

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Whathappenswhenamasternodegoesdown

Skalli