From a search head, how can we know which instance is the captain and which are members for that specific search head cluster?

[gunturu_nagasri]

How can this be viewed from Splunk Web using the S.o.S - Splunk on Splunk app in Splunk based on time?

[jplumsdaine22]

don't know about splunk on splunk, but you can view all the information in the Distributed Management Console

[hexx]

First, there are no plans to add views to the S.o.S app that will provide visibility & introspection for Search Head Clustering.

The good news, however, is that the Distributed Management Console ships with Search Head Clustering dashboards as of Splunk Enterprise 6.3!

Most notably, the very first view titled "Status and Configuration" provides an overview of your Search Head Cluster(s) and will show a list of cluster members and point out the captain.

Do note that this information is not available directly from search-heads that are members of the cluster as the DMC is not supported there - you'll need to set up an instance outside of the cluster (typically, the app deployer) to be the DMC and monitor the cluster from outside.

[jplumsdaine22]

Also the following search on a cluster member will tell you the captain

| rest splunk_server=local /services/shcluster/captain/info | rename label as Captain | fields Captain

[lguinn2]

Although on the command line on any search head, you can run

splunk show shcluster-status

which will tell you the status of the cluster and each member, including identifying the captain.