What is the impact of a search head cluster deployer failure, and how do I fix the problem?

[Steve_G_]

What problems arise if the deployer fails, and how important is it that I bring up a new deployer immediately? And how do I bring up a new deployer?

[Steve_G_ · Accepted solution]

While the deployer is down, you cannot deploy configuration bundle updates, such as apps, to the search head cluster members. Because all cluster members must use the same set of configurations, you must, with few exceptions, ensure that a member does not join or rejoin the cluster while the deployer is down.

If no member joins the cluster and you have no immediate need to push any new configurations, the cluster can continue to operate without a deployer indefinitely.

Otherwise, you must bring up a new deployer before a member joins or rejoins the cluster:

1. Create a new deployer instance.
2. Restore the contents of $SPLUNK_HOME/etc/shcluster to the new instance from backup.
3. If necessary, update the conf_deploy_fetch_url values on all search head cluster members.
4. Push the restored bundle contents to all members by running the splunk apply shcluster-bundle command.

For details, see http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/PropagateSHCconfigurationchanges#Conseq...