cluster communication Master ==> SH

[ndcl]

Hi,

in an cluster environment there is some bidirectional communication between the Master and a Searchhead. What I want to know is for what is the communication needed issued by the Master to the SH?
Do someone know that?

Thanks

[gjanders · Accepted solution]

As per Giuseppe's clarification the search heads communicate to the cluster master node in order to determine which search peers (or indexers if you prefer) are online and available for searching purposes.

From the documentation it is the search head initiating the communication with the cluster master (the documentation Enable the search head hints at this but does not advise if there is any communication the other way), the cluster master does not have a requirement to communicate with the search head as such (as in start the conversation with the search head as it only needs to coordinate the indexer activities).

If you use the cluster master for other purposes such as the DMC monitoring console then this might not be the case as the monitoring console will query each peer (on the REST port) to find health information...

[gcusello]

hi ndcl,
you were right, I was deceived on page http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Clusterdeploymentoverview where there isn't any connection between Master Node and Search head.
But vieving http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Configurethesearchhead, the search head takes the peers search configurations from the Master Node.
You have to configure Search Head setting the Master Node address and port and SH uses MN for peers configurations instead Distributed Search page on Splunk Web.
Sorry again.
Bye.
Giuseppe

[gcusello]

HI ndcl,
if you're speaking about the Deployer (the "Master" of a Search Head Cluster"), it "distributes apps and other configurations to the cluster members. It stands outside the cluster and cannot run on the same instance as a cluster member" (see http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/SHCarchitecture )
So there is a bidirectional traffic between them to check configurations and send updates.

If instead you're speaking about a Master Node of an Indexer cluster, there isn't any traffic between it and the SHs.
Bye.
Giuseppe

[ndcl]

sure? The first pic in the cluster setup guide said something different:
http://img203.imagevenue.com/img.php?image=113129262_Cluster_122_131lo.JPG

[ndcl]

and this too: http://downloads.jordan2000.com/splunk/Splunk-Common-Network-Ports-ver1.6.vsd
btw: of cause there is traffic between them... the SH needs to know the indexer peers, but this should be initiated by the SH...