Deployment Architecture

[Index Cluster] How CM in Indexer Clustering decide SH as down, and how we can tune configuration just like for Cluster Peers?

rbal_splunk
Splunk Employee
Splunk Employee

CM proclaims a SH is down if it misses 2x generation_poll_interval (set on the SH)

setting:
server.conf
299 #only valid for mode=master or mode=searchhead$
300 generation_poll_interval = 5$

Tags (1)

rbal_splunk
Splunk Employee
Splunk Employee

If you see Search Heads' status "Down", you can try it to increase the number.
60 sec is a good candidate.

server.conf in etc/system/default set it to 5 ( this is default) .spec file is incorrect

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...