Deployment Architecture

What do the status flags mean in a Search Head Cluster?

mciudad
Explorer

When showing the Search Head Cluster status, we get something similar to this:

./splunk show shcluster-status

 Captain:
                  dynamic_captain : 0
                  elected_captain : Fri Sep 23 09:00:37 2016
                               id : B997E10B-0E99-4363-9887-66DE2BF8C379
                 initialized_flag : 1
                            label : shcaptain.cdn
                         mgmt_uri : https://10.17.240.141:8089
            min_peers_joined_flag : 1
             rolling_restart_flag : 0
               service_ready_flag : 1

But I'm having trouble finding documentation on that output.
- What's the difference between "initialized_flag" and "service_ready_flag"?
- What are the conditions for these flags to be 0 or 1?
- How many peers have to join for the "min_peers_joined_flag" to be 1? By "peers" it mean Splunk Indexers or members of the Search Head Cluster?

Thanks!

0 Karma

JamieTaschetti
New Member

That didnt answer the question of the init flag vs service flag

0 Karma

sowings
Splunk Employee
Splunk Employee

min_peers_joined_flag is true when there are at least as many search head peers as the replication_factor.

service_ready_flag is true when everything is up and running as expected "ready to go!"

dynamic_captain is true if the captain is selected by elections. If it's shown as 0, this is because you've assigned a static captain (no elections).

rolling_restart_flag is true when a rolling restart (either manual, or required by a "apply shcluster-bundle" from the deployer).

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...