RAFT is a Splunk Search Head Cluster Terminology" Raft distributed consensus". The process of Electing the search head captain dynamically is known as RAFT. Auto SH captain failover Elect new captain via RAFT, it is recorded in $SPLUNK_HOME$/var/log/splunk/_raft//log.
This file contains:
**Members register their list of artifacts, running jobs, alerts, and search load statistics to a new captain.
**New captain enables its scheduler and executes fix-ups if needed.
sample log in the crash.log -
"what(): error in raft entry file for node term Could not parse raft entry file. Search head clustering: Search head cluster member has a corrupted raft state.
2019-01-08 07:59:43.450 +0000 splunkd started (build a0c72a66db66) "