Who manages Splunk Captain and how?

[nihar3012]

Who manages Splunk Captain and how?

[richgalloway · Accepted solution]

Usually, the Search Head Cluster (SHC) Captain is not managed at all.  The SHC members select a Captain automatically using a modified RAFT algorithm.  You can manually designate a Captain, at which point you become the manager.  See https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/SHCarchitecture#Search_head_cluster_ca...for more information.

[isoutamo]

Hi

couple of articles & visualization about RAFT.

• https://raft.github.io
• https://www.geeksforgeeks.org/raft-consensus-algorithm/
• https://en.wikipedia.org/wiki/Raft_(algorithm)

As @richgalloway said, usually SHC is automatically maintained. If needed (e.g. lost site) you can manually select (temporary) captain for it if there haven't been enough nodes to get consensus back. But if you take care of that manually, you must give it back manually as soon as situation is over. It cannot go back to normal situation without your manual steps.

r. Ismo