I was really looking forward to getting rid of search head pooling. Been a thorn in my side since implementing splunk.
Is it coming in a 6.2. dot release or 6.3?
Search head clustering is available on all operating systems supported for Splunk Enterprise
Check the link
http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/SHCsystemrequirements,Check the link
Search head clustering is available on all operating systems supported for Splunk Enterprise
Check the link
http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/SHCsystemrequirements,Check the link
That's correct. SHC is supported on Windows starting with 6.3
I just setup search head clustering in AWS with windows server 2008 r2.
I havent setup a deployer yet, but searches are working and the shcluster status command looks good. I even did it with just 2 search heads instead of 3. (replication factor 2).
I used this binary: splunk-6.2.0-237341-x64-release.msi
You got me really confused now..
READTHISFIRST says near the bottom "No support for search head clustering in Windows
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements
The above document says
Splunk does not currently support search head clustering on Windows systems.
It also says:
You must deploy at least as many members as either the replication factor or three, whichever is greater.
But I have a replication factor of 2, and only 2 search heads. 3 is greater than 2 and is therefore the minimum according to the document. However, I'm up and running on a 2 search head, search head cluster right now in Windows 2008 R2 SP1 and it works flawlessly.
I cant get the photo upload to work right now but I'm serious. Works fine.
The document correctly states that SHC is not 'supported' on windows, which means that if you run SHC on windows and run into a bug and call support for help, they would refuse to take a look because it is not officially supported. That's the risk of running any unsupported version in production.
As you rightly demonstrated, it is possible to setup a small cluster on Windows. However, SHC haven't gone through our extensive testing on Windows during 6.2 time frame, hence we are not supporting it in 6.2 and the support will be added in the next version of Splunk.
Thanks for the follow up Mahamed. That's what I assumed the issue was.
Here's a thought though, why did we deprecate search head pooling while not supporting search head clustering for windows? That effectively means we dont want users of the 6.2 windows version using clusters or pools.
This is why I interpreted it as support coming very soon, probably works fine already. So I have about 3 months before I put this thing in production. Can you guess if the supported release will be available in less than 3 months?
Deprecation means the feature is still in the product but will be removed in the later releases. So if you must run on windows, your best bet would be to use SHP on windows in 6.2 and migrate to SHC later.
My guess is that it would take longer than 3 months
Not really. We had 2 options. Either delay releasing SHC altogether until all platforms are available OR release SHC on Linux now and add windows support in the next release. We went with second option. Not ideal, but at least Linux users are able to take advantage of the SHC features now.
Deprecation is a frequent point of confusion. If something is deprecated, it's still supported, and the feature in question is still going to be around for (at least) 2 more major versions. That could easily be a couple of years, or longer. Deprecation is a great planning tool.
Thank you very much Mahamed.
Linux FTW!
Cheers!
I dont have anything against Linux...The problem is there are more support silos I have to deal with. I can count about 3-4 teams that have their portion of linux support at my company. OS/Security/E-trust/Etc
Windows...i can bypass all them and support the servers all by myself.
Thank you so much Mahamed! Cheers!
Translation:
Windows is low on our priority list and it might make it into next years .conf release.
If I knew how splunk would treat the windows platform...I would not have picked windows as the OS for my 40+ systems. Unfortunately due to the evil custom security layer on unix, windows was the lesser evil of the two.
PS C:\Program Files\Splunk\bin> .\splunk.exe show shcluster-status -auth admin:admin
Captain:
elected_captain : Fri Oct 31 17:19:06 2014
id : CF508875-4F9F-48BB-8CED-0766FA046729
initialized_flag : 1
label : WIN-DB5M3IDFOBE
maintenance_mode : 0
mgmt_uri : https://172.31.16.105:8089
min_peers_joined_flag : 1
rolling_restart_flag : 0
service_ready_flag : 1
Members:
WIN-DB5M3IDFOBE
label : WIN-DB5M3IDFOBE
mgmt_uri : https://172.31.16.105:8089
status : Up
WIN-9FRI2MKI5GV
label : WIN-9FRI2MKI5GV
mgmt_uri : https://172.31.23.67:8089
status : Up
It will not available in a 6.2.x maintenance release. It would have to wait until a future minor (or major) release. (Note that the version number of the next non-maintenance release of Splunk has not yet been determined.)