Deployment Architecture

Cluster Master

garima_chauhan
Path Finder

Hi,

I am using cluster set up with all instances of Splunk v5.0.5. I wanted to know what happens if the master goes down. The following link explains that the peers and search head will continue to work without any problem. A problem would only occur if one of the peers also goes down, in which case a standby master node can be of help.

http://docs.splunk.com/Documentation/Splunk/5.0.5/Indexer/Whathappenswhenamasternodegoesdown

I have a few questions, in the event that master node goes down:

  1. Is there any explicit time for which the peers and search head continue to work properly if all these are up and working.
  2. What else, apart from one of the peers going down, would arouse the need of a stand by cluster master?

Please confirm if my understanding is correct. Also, do answer my queries. Any help would be appreciated.

Tags (2)
0 Karma
1 Solution

joebensimo
Path Finder

In my experience, with Splunk v5.0.x, there is no explicit time for which the search head and peers continue to work after a master goes down. I've had them continue to work, but also had them fail in under a half hour. As the document says, "treat a downed master as a serious failure" and start fixing the problem immediately.

Also, with Splunk v5.0.x, I've found that bringing the master back online may put the cluster in a bad state for a while.

The most common problems I've seen when a master is down is that searches return incomplete data; however, I've also see a cluster become completely unsearchable.

In my experience, v5 handles clustering very poorly. I highly recommend you upgrade to v6.

View solution in original post

joebensimo
Path Finder

In my experience, with Splunk v5.0.x, there is no explicit time for which the search head and peers continue to work after a master goes down. I've had them continue to work, but also had them fail in under a half hour. As the document says, "treat a downed master as a serious failure" and start fixing the problem immediately.

Also, with Splunk v5.0.x, I've found that bringing the master back online may put the cluster in a bad state for a while.

The most common problems I've seen when a master is down is that searches return incomplete data; however, I've also see a cluster become completely unsearchable.

In my experience, v5 handles clustering very poorly. I highly recommend you upgrade to v6.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...