Deployment Architecture

Need to know about _raft directory on Search Head Cluster Members.

rbal_splunk
Splunk Employee
Splunk Employee

For Search Head Cluster Members splunk has a _raft directory

alt text

What do each of these entries mean?

0 Karma

anaidu_splunk
Splunk Employee
Splunk Employee

RAFT is a Splunk Search Head Cluster Terminology" Raft distributed consensus". The process of Electing the search head captain dynamically is known as RAFT. Auto SH captain failover Elect new captain via RAFT, it is recorded in $SPLUNK_HOME$/var/log/splunk/_raft//log.

This file contains:
**Members register their list of artifacts, running jobs, alerts, and search load statistics to a new captain.
**New captain enables its scheduler and executes fix-ups if needed.

If it is corrupted and a crash occurs follow below doc to troubleshoot.
https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Handleraftissues

sample log in the crash.log -
"what(): error in raft entry file for node term Could not parse raft entry file. Search head clustering: Search head cluster member has a corrupted raft state.
2019-01-08 07:59:43.450 +0000 splunkd started (build a0c72a66db66) "

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

0001 , 002 .. is the log entries commit ids

metadata1, metadata2 is a rolling record of current captaincy

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...