Deployment Architecture

Merge Indexer Cluster and Search Head Cluster after a Split Brain


How can a search head and an indexer cluster be merged after the cluster has been run intentionally in a split brain setup for some time.

e.g. the connections between two locations of a multi site cluster is broken and a captain has been assigned manualy to the second site.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Hi Fritz

The scenario is well documented on the following Splunk docs:

Handle master site failure:

Restart indexing in multisite cluster after master restart or site failure

Ensure that the peer and search head nodes can find the new master

Happy Splunking!

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...