Getting Data In

When will Search Head Clustering be enabled for Windows?

MartinMcNutt
Communicator

I was really looking forward to getting rid of search head pooling. Been a thorn in my side since implementing splunk.

Is it coming in a 6.2. dot release or 6.3?

1 Solution

rsathish47
Contributor

Search head clustering is available on all operating systems supported for Splunk Enterprise

Check the link

http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/SHCsystemrequirements,Check the link

View solution in original post

rsathish47
Contributor

Search head clustering is available on all operating systems supported for Splunk Enterprise

Check the link

http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/SHCsystemrequirements,Check the link

mahamed_splunk
Splunk Employee
Splunk Employee

That's correct. SHC is supported on Windows starting with 6.3

0 Karma

jkat54
SplunkTrust
SplunkTrust

I just setup search head clustering in AWS with windows server 2008 r2.

I havent setup a deployer yet, but searches are working and the shcluster status command looks good. I even did it with just 2 search heads instead of 3. (replication factor 2).

I used this binary: splunk-6.2.0-237341-x64-release.msi

0 Karma

MartinMcNutt
Communicator

You got me really confused now..

READTHISFIRST says near the bottom "No support for search head clustering in Windows

0 Karma

jkat54
SplunkTrust
SplunkTrust

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements

The above document says

Splunk does not currently support search head clustering on Windows systems.

It also says:

You must deploy at least as many members as either the replication factor or three, whichever is greater.

But I have a replication factor of 2, and only 2 search heads. 3 is greater than 2 and is therefore the minimum according to the document. However, I'm up and running on a 2 search head, search head cluster right now in Windows 2008 R2 SP1 and it works flawlessly.

I cant get the photo upload to work right now but I'm serious. Works fine.

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

The document correctly states that SHC is not 'supported' on windows, which means that if you run SHC on windows and run into a bug and call support for help, they would refuse to take a look because it is not officially supported. That's the risk of running any unsupported version in production.

As you rightly demonstrated, it is possible to setup a small cluster on Windows. However, SHC haven't gone through our extensive testing on Windows during 6.2 time frame, hence we are not supporting it in 6.2 and the support will be added in the next version of Splunk.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Thanks for the follow up Mahamed. That's what I assumed the issue was.

Here's a thought though, why did we deprecate search head pooling while not supporting search head clustering for windows? That effectively means we dont want users of the 6.2 windows version using clusters or pools.

This is why I interpreted it as support coming very soon, probably works fine already. So I have about 3 months before I put this thing in production. Can you guess if the supported release will be available in less than 3 months?

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

Deprecation means the feature is still in the product but will be removed in the later releases. So if you must run on windows, your best bet would be to use SHP on windows in 6.2 and migrate to SHC later.

  • Can you guess if the supported release will be available in less than 3 months?

My guess is that it would take longer than 3 months

  • Windows is low on our priority list and it might make it into next years .conf release.

Not really. We had 2 options. Either delay releasing SHC altogether until all platforms are available OR release SHC on Linux now and add windows support in the next release. We went with second option. Not ideal, but at least Linux users are able to take advantage of the SHC features now.

halr9000
Motivator

Deprecation is a frequent point of confusion. If something is deprecated, it's still supported, and the feature in question is still going to be around for (at least) 2 more major versions. That could easily be a couple of years, or longer. Deprecation is a great planning tool.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Thank you very much Mahamed.

Linux FTW!

Cheers!

0 Karma

MartinMcNutt
Communicator

I dont have anything against Linux...The problem is there are more support silos I have to deal with. I can count about 3-4 teams that have their portion of linux support at my company. OS/Security/E-trust/Etc

Windows...i can bypass all them and support the servers all by myself.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Thank you so much Mahamed! Cheers!

0 Karma

MartinMcNutt
Communicator

Translation:

Windows is low on our priority list and it might make it into next years .conf release.

If I knew how splunk would treat the windows platform...I would not have picked windows as the OS for my 40+ systems. Unfortunately due to the evil custom security layer on unix, windows was the lesser evil of the two.

0 Karma

jkat54
SplunkTrust
SplunkTrust
PS C:\Program Files\Splunk\bin> .\splunk.exe show shcluster-status -auth admin:admin

 Captain:
                          elected_captain : Fri Oct 31 17:19:06 2014
                                       id : CF508875-4F9F-48BB-8CED-0766FA046729
                         initialized_flag : 1
                                    label : WIN-DB5M3IDFOBE
                         maintenance_mode : 0
                                 mgmt_uri : https://172.31.16.105:8089
                    min_peers_joined_flag : 1
                     rolling_restart_flag : 0
                       service_ready_flag : 1

 Members:
        WIN-DB5M3IDFOBE
                                    label : WIN-DB5M3IDFOBE
                                 mgmt_uri : https://172.31.16.105:8089
                                   status : Up
        WIN-9FRI2MKI5GV
                                    label : WIN-9FRI2MKI5GV
                                 mgmt_uri : https://172.31.23.67:8089
                                   status : Up
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It will not available in a 6.2.x maintenance release. It would have to wait until a future minor (or major) release. (Note that the version number of the next non-maintenance release of Splunk has not yet been determined.)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...