Splunk Mania

Scenario based
Splunk Admin
Use Case 1

Cluster Manager / Master

@SplunkMania #SplunkMania
 Splunk Mania

What happens, If
Cluster Master down?

Quick answer is:

Indexers & Search heads will function normally,
no sudden failure, but we should consider it as
serious failure, which needs to be fixed as soon
as possible.
Detailed Explanation

@SplunkMania #SplunkMania
 Splunk Mania

Peers can continue to ingest data

@SplunkMania #SplunkMania
 Splunk Mania

Peers can stream copies to other peers,

replicate buckets

@SplunkMania #SplunkMania
 Splunk Mania

Peers Respond to search requests from

the search head, at least for a while.

@SplunkMania #SplunkMania
 Splunk Mania

Search head will display a warning if one

or more peers in the last generation are
down.

@SplunkMania #SplunkMania
 Splunk Mania

If any one of peer is down, there is no way to coordinate

the necessary remedial bucket-fixing activity

@SplunkMania #SplunkMania
 Splunk Mania

if a forwarder restarts while the manager is down, it will not

have a list of peer nodes and will not be able to forward
data, resulting in potential data loss.

@SplunkMania #SplunkMania