Deployment Architecture

[Index Cluster] How CM in Indexer Clustering decide SH as down, and how we can tune configuration just like for Cluster Peers?

rbal_splunk
Splunk Employee
Splunk Employee

CM proclaims a SH is down if it misses 2x generation_poll_interval (set on the SH)

setting:
server.conf
299 #only valid for mode=master or mode=searchhead$
300 generation_poll_interval = 5$

Tags (1)

rbal_splunk
Splunk Employee
Splunk Employee

If you see Search Heads' status "Down", you can try it to increase the number.
60 sec is a good candidate.

server.conf in etc/system/default set it to 5 ( this is default) .spec file is incorrect

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...