Deployment Architecture

[Index Cluster] How CM in Indexer Clustering decide SH as down, and how we can tune configuration just like for Cluster Peers?

rbal_splunk
Splunk Employee
Splunk Employee

CM proclaims a SH is down if it misses 2x generation_poll_interval (set on the SH)

setting:
server.conf
299 #only valid for mode=master or mode=searchhead$
300 generation_poll_interval = 5$

Tags (1)

rbal_splunk
Splunk Employee
Splunk Employee

If you see Search Heads' status "Down", you can try it to increase the number.
60 sec is a good candidate.

server.conf in etc/system/default set it to 5 ( this is default) .spec file is incorrect

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...