Scenario-based Splunk Admin Use Case 1

07.07.24 07:34 PM - By Murugan

What happens, If Cluster Master is down?

  • Indexers and search heads will function normally, no sudden failure, but we should consider it as a severe failure, which needs to be fixed as soon as possible.
  • The search head will display a warning if one or more peers in the last generation are down.
  • If any one of peers is down, there is no way to coordinate the necessary remedial bucket-fixing activity
  • if a forwarder restarts while the manager is down, it will not have a list of peer nodes and will not be able to forward data, resulting in potential data loss.

Murugan