Deployment Architecture

Merge Indexer Cluster and Search Head Cluster after a Split Brain


How can a search head and an indexer cluster be merged after the cluster has been run intentionally in a split brain setup for some time.

e.g. the connections between two locations of a multi site cluster is broken and a captain has been assigned manualy to the second site.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Hi Fritz

The scenario is well documented on the following Splunk docs:

Handle master site failure:

Restart indexing in multisite cluster after master restart or site failure

Ensure that the peer and search head nodes can find the new master

Happy Splunking!

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...