Need more details about SH clustering

[thevikramyadav]

I'm getting confused in SH clustering, can someone help me.

[inventsekar]

Hi @thevikramyadav .. 

As you are aware, good questions will receive better answers! 

- are you confused about search factor, replication factor, etc

- are you confused about SHC maintenance, support tasks.. 

- are you confused about why SHC needed in first place?

- are you confused about SHC and distributed searching?.. 

- are you confused about licensing for SHC.. or something else.. 

Best Regards

Sekar

[SanjayReddy · Accepted solution]

Hi @thevikramyadav 

In addtion to @PickleRick answer , below is the basic understandinf of  SH cluster 

Search head cluster need minimum of 3 search heads and max 100  

Group of search heads where apps, search, artifacts and jobs scheduling are same

• Group of search heads
• replicates knowledge objects
• replicates search artifacts
• increases search accessibility

Advantages

• Horizontal scaling
• High availability
• No single point of failure

- Deployer

• Centralized location to distribute apps and other configurations to search head cluster members
• Not participate in searches

- Captain

- Its a cluster member with additional responsibilities
- responsible include

- Scheduling jobs/searches
- Coordinating alerts and alerts suppression across the cluster
- Pushes the knowledge bundle to search peers(indexers)
- Coordinating artifacts replication
- Replicating configuration updates

- Cluster members

- Same as search head in single instance
- Participate in searches

- Load balancer (optional)

- 3rd party software
- Resides between users and cluster members

- Replication factor

- Determines the number of copies of each artifact/search result
- Only artifact/search result from scheduled saves searches are replicated
- Results from ad hoc searches or real time searches are not replicated
- by default, schedules saves searches results are stored in
- $SPLUNK_HOME/var/run/splunk/dispatch/search/

- Search peers
         - These Indexers where data is searched

[PickleRick]

https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/AboutSHC

Don't hesitate to ask specific questions you have after reading through the docs.