Master node shows up as Search head

[dif2175509]

I have defined a cluster as follows:

Splunk-mstb (cluster master)
|
Splunkb (Search head in the cluster)
|
splunk-idxb
|
splunk-fwdb

and both my Splunkb and splunk-mstb show up as search heads.

My server.conf only has the following in it:

[clustering]
mode = master

How can I remove the errant Search head entry (and from where)?

[dif2175509]

There is no overlap between msta and mstb clusters.

All the VM names are correct (as well as the names within the Splunk instance). I have built the clusters but not defined any indexes yet.

The GUI in the cluster, msta, shows the correct indexer peers (idxa and idxc) and search head (splunka)

The GUI in the cluster, mstb, shows the correct index peer (idxb) and two search heads (mstb and splunkb).

If i was getting similar behavior in both clusters it would not cause concern.

[bheemireddi]

dif2175509,

When you configure the indexer cluster, cluster master will show up as one of the search heads. This is default behavior.In this case you can use the master node for the troubleshooting purposes and not really for production searches.

[dif2175509]

I have a second cluster defined:

Splunk-msta (cluster master)
|
Splunka (Search head in the cluster)
|                  |
splunk-idxa  & splunk-idxc
|
splunk-fwda

and only splunka shows up as search heads (not splunka and splunk-msta).

Why do i not see same behavior with this cluster?

[bheemireddi]

Are you sure of the configurations on this cluster where you don't see Cluster master as the search head?
Do you see the cluster enabled when you login to the Cluster Master GUI? is the master configured with correct mode? your hostnames overlap between first and second cluster.. hopefully you have the right names in the configurations