Why in a 4 site Search Head Cluster captain is getting elected automatically?

[schose]

Hi Forum,

I'm integrating a streched SHC running in 4 sites. Each site have 1 SHC Member. When booting the SHC up the captain is elected automatically.

from the docs i learned:
http://docs.splunk.com/Documentation/Splunk/6.6.7/DistSearch/DeploymultisiteSHC

"If the site with a majority of members fails, the remaining members on the minority site cannot elect a new captain. Captain election requires the vote of a majority of members, but only a minority of members are running. The cluster does not function. See "Consequences of a non-functioning cluster."

"If the network between sites fails, the members on each site will attempt to elect a captain. However, only a site that holds a majority of the total members will succeed. That site can continue to function as the cluster indefinitely."

So as I'm having 4 shc members in 4 sites I never have any kind of majority in any site. So I would guess captain election should never work correctly. Any hint why it's working correctly?

Best regards,

Andreas

[Steve_G_ · Accepted solution]

The doc is describing a failure in the the common case of a two-site cluster. The key point is that you must have a majority of members, across all sites, up-and-running and in communication, for the cluster to function. This is also discussed at length elsewhere in the docs. (See, for example, http://docs.splunk.com/Documentation/Splunk/7.1.2/DistSearch/SHCarchitecture .)

As long as you have a majority (>50%) of the entire set of cluster members running and communicating, the cluster can function. It doesn't matter if they're on one site or a hundred. So, for the deployment you describe, you're fine, as long as you don't suffer the loss of two sites, which would cause you to lose the majority.