What is recommended for migrating from my current Search Head Pooling setup to Search Head Clustering?

[mfrost8]

As of Splunk 6.2, I see that search head pooling has been deprecated so I need to consider changing course from the infrastructure we've already embarked upon and think about how do I go from pooling to clustering for search heads.

Right now the SH pooling I'm doing is pretty light but poised to be expanded. The most we have is 2 pooled servers behind a load balancer. I see there's different Splunk configuration (expected) and it appears that the requirement for NFS storage goes away.

In terms of thinking of a transition period, it looks like the minimum for SH clustering is 3 cluster members. So if I've got only 2 servers (and need only 2 at present), I take it this means I have to build a 3rd SH to be able to move to SH clustering? Or did I misunderstand the documentation I read?

Also, it's not practical to mount NFS volumes across a WAN so we've created unique pools per geographic datacenter. Does SH clustering now make it practical to create a cross-WAN cluster so that no matter which geographic search head a user logs in to they will get their same saved searches, dashboards, etc?

Thanks

[jnicholsenernoc]

Are people successfully deploying search head clustering over the WAN?

[ppablo]

Hi @jnicholsenernoc

Please don't use the answer space on someone else's post to ask a question. Please post your question as a completely new post.

[awilliams_splun · Accepted solution]

Yes, a minimum of 3 systems is required for SH Clustering. This is largely do to the SH Cluster captain election process. In SH cluster the SH cluster has what is called a Captain. The captain is used to coordinate activities across the SH Cluster to include:

• Schedule jobs across the cluster
• Push knowledge bundles to peers
• Replicate the various search artifacts to peers
• Replicate any configuration changes made to peers (the use of deployer server is required for config changes. system side config changes should not be made locally)
• Coordinating alerts
• etc

When the system is brought up for the first time or the scheduled/unscheduled restart of the captain, a election process occurs to elect a new captain. This election process requires a 51% majority vote from all members in the cluster. This would not be achievable in a two node cluster.

[MartinMcNutt]

Also note....Windows is not a support Operating system for SH Cluster as of 6.2.1.

[phoffman_splunk]

SHC Architecture link; this outlines the basics

[mfrost8]

So ultimately, once search head pooling is gone, you can run 1 standalone search head, or 3+ search heads in a clustered configuration. There is no solution whereby you can use 2 search heads (even if you don't need 3).

Thanks.