Hi Fritz
The scenario is well documented on the following Splunk docs:
Handle master site failure:
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Mastersitefailure
Restart indexing in multisite cluster after master restart or site failure
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Restartindexing
Ensure that the peer and search head nodes can find the new master
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Handlemasternodefailure#Ensure_that_the_peer_and_search_head_nodes_can_find_the_new_master
Happy Splunking!
Alain
... View more