Deployment Architecture

Raft State Machine

verbal_666
Builder

Hi.
I do not understand well the SHC config,

[raft_statemachine]

disabled = <boolean>
* Set to true to disable the raft statemachine.
* This feature requires search head clustering to be enabled.
* Any consensus replication among search heads uses this feature.
* Default: true

replicate_search_peers = <boolean>
* Add/remove search-server request is applied on all members
  of a search head cluster, when this value to set to true.
* Requires a healthy search head cluster with a captain.

 What changes in a SHC by setting "disabled = true or false"? By default is true.


"replicate_search_peers = true" works only if disabled is false.

 

What does setting this to true or false do to the cluster?

0 Karma
1 Solution

sainag_splunk
Splunk Employee
Splunk Employee

The disabled setting in SHC only impacts captain election and member roster management.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

https://en.m.wikipedia.org/wiki/Raft_(algorithm)

Without raft algorithm your captain election will not work properly. You might get away with static captain but it's not fault tolerant so if you lose your static captain your SHC will more or less fall apart.

0 Karma

verbal_666
Builder

I neved had problems with Captain Election, both with

[raft_statemachine]
disabled = true
disabled = false

🤷‍

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's not the only factor in captain election. So just because you have raft enabled doesn't mean that your election will work properly.

sainag_splunk
Splunk Employee
Splunk Employee
@verbal_666 May I know the reason you are tryin to update this?

Basically replicate search peers is when you want to  add a non-clustered indexer via the GUI, replicate that to your other SHC peers, I don't think that required. 
 
 
 
 
I have only seen  replicate_search_peers is used where you have search head cluster is in use with no index clustering, so if you want to search the non clustered indexers, its set to false.  If you want it to replicate its set to true.

replicate_search_peers = true
  • Only works if disabled = false
  • Automatically copies search peer connections to all SHC members
  • Most useful when connecting SHC to non-clustered indexers


If this helps., Please Upvote
0 Karma

verbal_666
Builder

Don't understand the question 🙄🙄🙄

I have a non clustered Indexing infrastructure (8 standalone indexers).


@sainag_splunk wrote:
I don't think that required. 

I decide what's required 😉and i want the SHC to replicate distsearch.conf 😉😉

My question was another, leave replicate_search_peers away,


What changes in a SHC by setting "disabled = true or false"? By default is true.

0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

The disabled setting in SHC only impacts captain election and member roster management.

verbal_666
Builder

@sainag_splunk wrote:

The disabled setting in SHC only impacts captain election and member roster management.


Ok, so it's minimal, and has ne real impact of cluster operativity 👍

Thanks 👍

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...