Enable the master node
Before reading this topic, read "Deployment overview".
A cluster has one, and only one, master node. The master node coordinates the activities of the peer nodes. It does not itself store or replicate data (aside from its own internal data).
Important: A master node cannot do double duty as a peer node. The Splunk Enterprise instance that you enable as master node must perform only that single role. In addition, the master cannot share a machine with a peer.
You must enable the master node as the first step in deploying a cluster, before setting up the peer nodes.
Note: The procedure in this topic explains how to use Splunk Web to enable a master node. You can also enable a master in two other ways:
- Directly edit the master's
server.conffile. See "Configure the cluster with server.conf" for details. Some advanced settings can only be configured by editing this file.
- Use the CLI
edit cluster-configcommand. See "Configure the cluster with the CLI" for details.
Enable the master
To enable an indexer as the master node:
1. Click Settings in the upper right corner of Splunk Web.
2. In the Distributed environment group, click Clustering.
3. Select Enable clustering.
4. Select Master node and click Next.
5. There are a few fields to fill out:
- Replication Factor.The replication factor determines how many copies of data the cluster maintains. The default is 3. For more information on the replication factor, see "Replication factor". Choose the right replication factor now. It is inadvisable to increase the replication factor later, once the cluster has significant amounts of data.
- Search Factor. The search factor determines how many immediately searchable copies of data the cluster maintains. The default is 2. For more information on the search factor, see "Search factor". Choose the right search factor now. It is highly inadvisable to increase the search factor later, once the cluster has significant amounts of data.
- Security Key. This is the key that authenticates communication between the master and the peers and search heads. The key must be the same across all cluster instances. If you leave the field empty here, leave it empty on the peers and search heads as well.
6. Click Enable master node.
7. The message appears, "You must restart Splunk for the master node to become active. You can restart Splunk from Server Controls." Click Go to Server Controls to go to the Settings page where you can initiate the restart.
Important: When the master starts up for the first time, it will block indexing on the peers until you have enabled and restarted the full replication factor number of peers.
To learn about advanced configuration of the master node, read "Configure the master".
View the master dashboard
After the restart, log back into the master and return to the Clustering page in Splunk Web. This time, you see the master clustering dashboard. For information on the dashboard, see "View the master dashboard".
Perform additional configuration
For information on post-deployment master node configuration, read "Configure the master" in this manual.
System requirements and other deployment considerations
Enable the peer nodes
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15