Deployment Architecture
Highlighted

cluster communication Master ==> SH

Path Finder

Hi,

in an cluster environment there is some bidirectional communication between the Master and a Searchhead. What I want to know is for what is the communication needed issued by the Master to the SH?
Do someone know that?

Thanks

0 Karma
Highlighted

Re: cluster communication Master ==> SH

Legend

HI ndcl,
if you're speaking about the Deployer (the "Master" of a Search Head Cluster"), it "distributes apps and other configurations to the cluster members. It stands outside the cluster and cannot run on the same instance as a cluster member" (see http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/SHCarchitecture )
So there is a bidirectional traffic between them to check configurations and send updates.

If instead you're speaking about a Master Node of an Indexer cluster, there isn't any traffic between it and the SHs.
Bye.
Giuseppe

0 Karma
Highlighted

Re: cluster communication Master ==> SH

Path Finder

sure? The first pic in the cluster setup guide said something different:
http://img203.imagevenue.com/img.php?image=113129262_Cluster_122_131lo.JPG

0 Karma
Highlighted

Re: cluster communication Master ==> SH

Path Finder

and this too: http://downloads.jordan2000.com/splunk/Splunk-Common-Network-Ports-ver1.6.vsd
btw: of cause there is traffic between them... the SH needs to know the indexer peers, but this should be initiated by the SH...

0 Karma
Highlighted

Re: cluster communication Master ==> SH

Legend

hi ndcl,
you were right, I was deceived on page http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Clusterdeploymentoverview where there isn't any connection between Master Node and Search head.
But vieving http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Configurethesearchhead, the search head takes the peers search configurations from the Master Node.
You have to configure Search Head setting the Master Node address and port and SH uses MN for peers configurations instead Distributed Search page on Splunk Web.
Sorry again.
Bye.
Giuseppe

0 Karma
Highlighted

Re: cluster communication Master ==> SH

SplunkTrust
SplunkTrust

As per Giuseppe's clarification the search heads communicate to the cluster master node in order to determine which search peers (or indexers if you prefer) are online and available for searching purposes.

From the documentation it is the search head initiating the communication with the cluster master (the documentation Enable the search head hints at this but does not advise if there is any communication the other way), the cluster master does not have a requirement to communicate with the search head as such (as in start the conversation with the search head as it only needs to coordinate the indexer activities).

If you use the cluster master for other purposes such as the DMC monitoring console then this might not be the case as the monitoring console will query each peer (on the REST port) to find health information...

View solution in original post

0 Karma