Splunk Enterprise

Master node shows up as Search head

dif2175509
New Member

I have defined a cluster as follows:

Splunk-mstb (cluster master)
|
Splunkb (Search head in the cluster)
|
splunk-idxb
|
splunk-fwdb

and both my Splunkb and splunk-mstb show up as search heads.

My server.conf only has the following in it:

[clustering]
mode = master

How can I remove the errant Search head entry (and from where)?

Tags (1)
0 Karma

dif2175509
New Member

There is no overlap between msta and mstb clusters.

All the VM names are correct (as well as the names within the Splunk instance). I have built the clusters but not defined any indexes yet.

The GUI in the cluster, msta, shows the correct indexer peers (idxa and idxc) and search head (splunka)

The GUI in the cluster, mstb, shows the correct index peer (idxb) and two search heads (mstb and splunkb).

If i was getting similar behavior in both clusters it would not cause concern.

0 Karma

bheemireddi
Communicator

dif2175509,

When you configure the indexer cluster, cluster master will show up as one of the search heads. This is default behavior.In this case you can use the master node for the troubleshooting purposes and not really for production searches.

0 Karma

dif2175509
New Member

I have a second cluster defined:

Splunk-msta (cluster master)
|
Splunka (Search head in the cluster)
|                  |
splunk-idxa  & splunk-idxc
|
splunk-fwda

and only splunka shows up as search heads (not splunka and splunk-msta).

Why do i not see same behavior with this cluster?

0 Karma

bheemireddi
Communicator

Are you sure of the configurations on this cluster where you don't see Cluster master as the search head?
Do you see the cluster enabled when you login to the Cluster Master GUI? is the master configured with correct mode? your hostnames overlap between first and second cluster.. hopefully you have the right names in the configurations

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...