Hi all,
I've got a search head cluster set up with three sites -- two relatively nearby, plus a search head in another location to act as a witness and provide the deciding vote if, for whatever reason, we lost one of our sites.
The main issue is that this search head is on minimal kit and is far enough away that the search heads start complaining that everything takes too long / keeps timing out.
Is there a way to prevent this search head from becoming the captain?
Best regards,
Alex
Try this if it's on 6.3
http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Transfercaptain
Unfortunately not -- hopefully should be soon, though. Thanks for the URL.
Please note that this is completely untested. I
I do see a attribute under [shclustering] which defines the time a member will wait before tying to become captain. My guess would be that if set this to a high value, the member would never be able to become captain (as the timer from others will end before this and they will get elected).
election_timeout_ms = <positive_integer>
* The amount of time that a member will wait before trying to become the
captain.
* Half of this value is the heartbeat period.
* A very low value of election_timeout_ms can lead to unnecessary captain
elections.
* The default is 60000ms, or 1 minute.
Giving it a go, will report back after a couple of cluster elections. Thanks for the idea!