- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Merge Indexer Cluster and Search Head Cluster after a Split Brain
![FritzWittwer_ol FritzWittwer_ol](https://community.splunk.com/legacyfs/online/avatars/150007.jpg)
How can a search head and an indexer cluster be merged after the cluster has been run intentionally in a split brain setup for some time.
e.g. the connections between two locations of a multi site cluster is broken and a captain has been assigned manualy to the second site.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
Hi Fritz
The scenario is well documented on the following Splunk docs:
Handle master site failure:
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Mastersitefailure
Restart indexing in multisite cluster after master restart or site failure
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Restartindexing
Ensure that the peer and search head nodes can find the new master
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Handlemasternodefailure#Ensure_that_the_pe...
Happy Splunking!
Alain
![](/skins/images/53C7C94B4DD15F7CACC6D77B9B4D55BF/responsive_peak/images/icon_anonymous_message.png)