Deployment Architecture

Is there way to prevent a certain search head from becoming the captain in a search head cluster?

alekksi
Communicator

Hi all,

I've got a search head cluster set up with three sites -- two relatively nearby, plus a search head in another location to act as a witness and provide the deciding vote if, for whatever reason, we lost one of our sites.

The main issue is that this search head is on minimal kit and is far enough away that the search heads start complaining that everything takes too long / keeps timing out.
Is there a way to prevent this search head from becoming the captain?

Best regards,
Alex

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

alekksi
Communicator

Unfortunately not -- hopefully should be soon, though. Thanks for the URL.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Please note that this is completely untested. I

I do see a attribute under [shclustering] which defines the time a member will wait before tying to become captain. My guess would be that if set this to a high value, the member would never be able to become captain (as the timer from others will end before this and they will get elected).

election_timeout_ms = <positive_integer>
* The amount of time that a member will wait before trying to become the
  captain.
* Half of this value is the heartbeat period.
* A very low value of election_timeout_ms can lead to unnecessary captain
  elections.
* The default is 60000ms, or 1 minute.
0 Karma

alekksi
Communicator

Giving it a go, will report back after a couple of cluster elections. Thanks for the idea!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...