Need to know about _raft directory on Search Head Cluster Members.

[rbal_splunk]

For Search Head Cluster Members splunk has a _raft directory

What do each of these entries mean?

[anaidu_splunk]

RAFT is a Splunk Search Head Cluster Terminology" Raft distributed consensus". The process of Electing the search head captain dynamically is known as RAFT. Auto SH captain failover Elect new captain via RAFT, it is recorded in $SPLUNK_HOME$/var/log/splunk/_raft//log.

This file contains:
**Members register their list of artifacts, running jobs, alerts, and search load statistics to a new captain.
**New captain enables its scheduler and executes fix-ups if needed.

If it is corrupted and a crash occurs follow below doc to troubleshoot.
https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Handleraftissues

sample log in the crash.log -
"what(): error in raft entry file for node term Could not parse raft entry file. Search head clustering: Search head cluster member has a corrupted raft state.
2019-01-08 07:59:43.450 +0000 splunkd started (build a0c72a66db66) "

[rbal_splunk]

0001 , 002 .. is the log entries commit ids

metadata1, metadata2 is a rolling record of current captaincy