What are the impacts of the cluster master being down for some period?

[jaracan]

Hi ream,

We would like to know what would be the impact on the Indexer Clustering tier if our Cluster Master (AWS EC2) will be down for some period of time. The reason is that there will be some AWS maintenance activity for the Cluster Master Splunk server instance (AWS EC2).

Can you share with us, what would be the impact on peer nodes, or on the Indexer Clustering tier as a whole? Or what should be our action maybe?

[nikita_p]

HI,
The master is essential to the proper running of an indexer cluster, with its role as coordinator for much of the cluster activity. However, if the master goes down, the peers and search head have default behaviors that allow them to function fairly normally, at least for a while. Nevertheless, you should treat a downed master as a serious failure.

To deal with the possibility of a downed master, you can configure a stand-by master that can take over if needed. You can go through the link below of Splunk docs for how to do this:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Whathappenswhenamasternodegoesdown

[dkeck · Accepted solution]

Hi,

have a look at this doc 🙂

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Whathappenswhenamasternodegoesdown