Deployment Architecture

cluster communication Master ==> SH

ndcl
Path Finder

Hi,

in an cluster environment there is some bidirectional communication between the Master and a Searchhead. What I want to know is for what is the communication needed issued by the Master to the SH?
Do someone know that?

Thanks

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

As per Giuseppe's clarification the search heads communicate to the cluster master node in order to determine which search peers (or indexers if you prefer) are online and available for searching purposes.

From the documentation it is the search head initiating the communication with the cluster master (the documentation Enable the search head hints at this but does not advise if there is any communication the other way), the cluster master does not have a requirement to communicate with the search head as such (as in start the conversation with the search head as it only needs to coordinate the indexer activities).

If you use the cluster master for other purposes such as the DMC monitoring console then this might not be the case as the monitoring console will query each peer (on the REST port) to find health information...

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

As per Giuseppe's clarification the search heads communicate to the cluster master node in order to determine which search peers (or indexers if you prefer) are online and available for searching purposes.

From the documentation it is the search head initiating the communication with the cluster master (the documentation Enable the search head hints at this but does not advise if there is any communication the other way), the cluster master does not have a requirement to communicate with the search head as such (as in start the conversation with the search head as it only needs to coordinate the indexer activities).

If you use the cluster master for other purposes such as the DMC monitoring console then this might not be the case as the monitoring console will query each peer (on the REST port) to find health information...

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi ndcl,
you were right, I was deceived on page http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Clusterdeploymentoverview where there isn't any connection between Master Node and Search head.
But vieving http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Configurethesearchhead, the search head takes the peers search configurations from the Master Node.
You have to configure Search Head setting the Master Node address and port and SH uses MN for peers configurations instead Distributed Search page on Splunk Web.
Sorry again.
Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI ndcl,
if you're speaking about the Deployer (the "Master" of a Search Head Cluster"), it "distributes apps and other configurations to the cluster members. It stands outside the cluster and cannot run on the same instance as a cluster member" (see http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/SHCarchitecture )
So there is a bidirectional traffic between them to check configurations and send updates.

If instead you're speaking about a Master Node of an Indexer cluster, there isn't any traffic between it and the SHs.
Bye.
Giuseppe

0 Karma

ndcl
Path Finder

sure? The first pic in the cluster setup guide said something different:
http://img203.imagevenue.com/img.php?image=113129262_Cluster_122_131lo.JPG

0 Karma

ndcl
Path Finder

and this too: http://downloads.jordan2000.com/splunk/Splunk-Common-Network-Ports-ver1.6.vsd
btw: of cause there is traffic between them... the SH needs to know the indexer peers, but this should be initiated by the SH...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...