Why am I having Issues with search head cluster- not seeing events

[sgarcia]

Hello everyone.

I have set up a cluster of 3 search heads, I have the Serach Head 1 configured as captain, but it turns out that there are times that I do not see events in that same SH1 and SH2, this causes alerts that I have configured in my SH1 to activate, since they do not events are displayed on the SH1. What I have to do is change how SH3 is populated and the display of events is restored, temporarily solving the problem. After a while I find out that SH1 takes the role of captain again and again I can't view events on SH1. Why could it be happening?

Regards.

[sgarcia]

Thanks isoutamo

[isoutamo]

Hi

unfortunately I didn't understand your issue 😞

Have you configured your environment like this:https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/SHCandindexercluster

It's crucial that you forward all internal logs to the indexer layers. And with SHC you must have a separate indexer or indexer cluster where all your data is. Also you should have UF's configured to sent events to indexers not to individual SHs.

With above configuration your SHC nodes should manage captain elections automatically and it's not matter which node is captain in any particular moment.

r. Ismo