All Apps and Add-ons

From a search head, how can we know which instance is the captain and which are members for that specific search head cluster?

gunturu_nagasri
Explorer

How can this be viewed from Splunk Web using the S.o.S - Splunk on Splunk app in Splunk based on time?

jplumsdaine22
Influencer

don't know about splunk on splunk, but you can view all the information in the Distributed Management Console

hexx
Splunk Employee
Splunk Employee

First, there are no plans to add views to the S.o.S app that will provide visibility & introspection for Search Head Clustering.

The good news, however, is that the Distributed Management Console ships with Search Head Clustering dashboards as of Splunk Enterprise 6.3!

Most notably, the very first view titled "Status and Configuration" provides an overview of your Search Head Cluster(s) and will show a list of cluster members and point out the captain.

Do note that this information is not available directly from search-heads that are members of the cluster as the DMC is not supported there - you'll need to set up an instance outside of the cluster (typically, the app deployer) to be the DMC and monitor the cluster from outside.

jplumsdaine22
Influencer

Also the following search on a cluster member will tell you the captain

| rest splunk_server=local /services/shcluster/captain/info | rename label as Captain | fields Captain
0 Karma

lguinn2
Legend

Although on the command line on any search head, you can run

splunk show shcluster-status

which will tell you the status of the cluster and each member, including identifying the captain.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!