Deployment Architecture

What do the status flags mean in a Search Head Cluster?

mciudad
Explorer

When showing the Search Head Cluster status, we get something similar to this:

./splunk show shcluster-status

 Captain:
                  dynamic_captain : 0
                  elected_captain : Fri Sep 23 09:00:37 2016
                               id : B997E10B-0E99-4363-9887-66DE2BF8C379
                 initialized_flag : 1
                            label : shcaptain.cdn
                         mgmt_uri : https://10.17.240.141:8089
            min_peers_joined_flag : 1
             rolling_restart_flag : 0
               service_ready_flag : 1

But I'm having trouble finding documentation on that output.
- What's the difference between "initialized_flag" and "service_ready_flag"?
- What are the conditions for these flags to be 0 or 1?
- How many peers have to join for the "min_peers_joined_flag" to be 1? By "peers" it mean Splunk Indexers or members of the Search Head Cluster?

Thanks!

0 Karma

JamieTaschetti
New Member

That didnt answer the question of the init flag vs service flag

0 Karma

sowings
Splunk Employee
Splunk Employee

min_peers_joined_flag is true when there are at least as many search head peers as the replication_factor.

service_ready_flag is true when everything is up and running as expected "ready to go!"

dynamic_captain is true if the captain is selected by elections. If it's shown as 0, this is because you've assigned a static captain (no elections).

rolling_restart_flag is true when a rolling restart (either manual, or required by a "apply shcluster-bundle" from the deployer).

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...