Deployment Architecture

Raft State Machine

verbal_666
Builder

Hi.
I do not understand well the SHC config,

[raft_statemachine]

disabled = <boolean>
* Set to true to disable the raft statemachine.
* This feature requires search head clustering to be enabled.
* Any consensus replication among search heads uses this feature.
* Default: true

replicate_search_peers = <boolean>
* Add/remove search-server request is applied on all members
  of a search head cluster, when this value to set to true.
* Requires a healthy search head cluster with a captain.

 What changes in a SHC by setting "disabled = true or false"? By default is true.


"replicate_search_peers = true" works only if disabled is false.

 

What does setting this to true or false do to the cluster?

0 Karma
1 Solution

sainag_splunk
Splunk Employee
Splunk Employee

The disabled setting in SHC only impacts captain election and member roster management.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

https://en.m.wikipedia.org/wiki/Raft_(algorithm)

Without raft algorithm your captain election will not work properly. You might get away with static captain but it's not fault tolerant so if you lose your static captain your SHC will more or less fall apart.

0 Karma

verbal_666
Builder

I neved had problems with Captain Election, both with

[raft_statemachine]
disabled = true
disabled = false

🤷‍

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's not the only factor in captain election. So just because you have raft enabled doesn't mean that your election will work properly.

sainag_splunk
Splunk Employee
Splunk Employee
@verbal_666 May I know the reason you are tryin to update this?

Basically replicate search peers is when you want to  add a non-clustered indexer via the GUI, replicate that to your other SHC peers, I don't think that required. 
 
 
 
 
I have only seen  replicate_search_peers is used where you have search head cluster is in use with no index clustering, so if you want to search the non clustered indexers, its set to false.  If you want it to replicate its set to true.

replicate_search_peers = true
  • Only works if disabled = false
  • Automatically copies search peer connections to all SHC members
  • Most useful when connecting SHC to non-clustered indexers


If this helps., Please Upvote
0 Karma

verbal_666
Builder

Don't understand the question 🙄🙄🙄

I have a non clustered Indexing infrastructure (8 standalone indexers).


@sainag_splunk wrote:
I don't think that required. 

I decide what's required 😉and i want the SHC to replicate distsearch.conf 😉😉

My question was another, leave replicate_search_peers away,


What changes in a SHC by setting "disabled = true or false"? By default is true.

0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

The disabled setting in SHC only impacts captain election and member roster management.

verbal_666
Builder

@sainag_splunk wrote:

The disabled setting in SHC only impacts captain election and member roster management.


Ok, so it's minimal, and has ne real impact of cluster operativity 👍

Thanks 👍

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...