Deployment Architecture

Is there way to prevent a certain search head from becoming the captain in a search head cluster?


Hi all,

I've got a search head cluster set up with three sites -- two relatively nearby, plus a search head in another location to act as a witness and provide the deciding vote if, for whatever reason, we lost one of our sites.

The main issue is that this search head is on minimal kit and is far enough away that the search heads start complaining that everything takes too long / keeps timing out.
Is there a way to prevent this search head from becoming the captain?

Best regards,

0 Karma



Unfortunately not -- hopefully should be soon, though. Thanks for the URL.

0 Karma

Revered Legend

Please note that this is completely untested. I

I do see a attribute under [shclustering] which defines the time a member will wait before tying to become captain. My guess would be that if set this to a high value, the member would never be able to become captain (as the timer from others will end before this and they will get elected).

election_timeout_ms = <positive_integer>
* The amount of time that a member will wait before trying to become the
* Half of this value is the heartbeat period.
* A very low value of election_timeout_ms can lead to unnecessary captain
* The default is 60000ms, or 1 minute.
0 Karma


Giving it a go, will report back after a couple of cluster elections. Thanks for the idea!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!