Deployment Architecture

Is there way to prevent a certain search head from becoming the captain in a search head cluster?

alekksi
Communicator

Hi all,

I've got a search head cluster set up with three sites -- two relatively nearby, plus a search head in another location to act as a witness and provide the deciding vote if, for whatever reason, we lost one of our sites.

The main issue is that this search head is on minimal kit and is far enough away that the search heads start complaining that everything takes too long / keeps timing out.
Is there a way to prevent this search head from becoming the captain?

Best regards,
Alex

0 Karma

renjith_nair
Legend

Try this if it's on 6.3

http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Transfercaptain
---
What goes around comes around. If it helps, hit it with Karma 🙂

alekksi
Communicator

Unfortunately not -- hopefully should be soon, though. Thanks for the URL.

0 Karma

somesoni2
Revered Legend

Please note that this is completely untested. I

I do see a attribute under [shclustering] which defines the time a member will wait before tying to become captain. My guess would be that if set this to a high value, the member would never be able to become captain (as the timer from others will end before this and they will get elected).

election_timeout_ms = <positive_integer>
* The amount of time that a member will wait before trying to become the
  captain.
* Half of this value is the heartbeat period.
* A very low value of election_timeout_ms can lead to unnecessary captain
  elections.
* The default is 60000ms, or 1 minute.
0 Karma

alekksi
Communicator

Giving it a go, will report back after a couple of cluster elections. Thanks for the idea!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...