Deployment Architecture

Splunk Cluster Master Server Fault Tolerance

micatcloudon
Engager

Greetings!
While the fault tolerance for the Splunk Cluster node is clear.
I wonder How Splunk Cluster would recover from the Splunk Master server loss ?
What is the remedy procedure ?

Tags (1)
0 Karma

Drainy
Champion

Essentially you can start up a new master node with the same IP/DNS details and it will assume the role of the original as the other answer aludes to, however the truth is that the master itself has no HA or fault tolerance.

If you were to experience an event which took a master and an indexer offline you would be left in an inconsistant state, as per Starfleets situation here; http://splunk-base.splunk.com/answers/65397/splunk-v5-clustering-and-ha

Its still a much improved HA solution and its pretty good to be fair, but there really needs to be better tolerance for the master failing 🙂

roychen
Path Finder

Hi,

You simply need to restore the master node, and the peers in the cluster will communicate with the master regarding the current state of the cluster (number of replicated copies / searchable copies, etc).

To make sure you can restore a master node ASAP, you might want to keep a standby master node, as per the instructions in:

http://docs.splunk.com/Documentation/Splunk/5.0.1/Indexer/Configurethemaster#Configure_a_stand-by_ma...

Hope this helps.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...