Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

View the search head dashboard

This dashboard provides detailed information on the status of the search head.

Access the dashboard

To access the dashboard:

1. On the search head, click Settings in the upper right corner of Splunk Web.

2. In the Distributed environment group, click Clustering.

You can only view this dashboard on an instance that has already been enabled as a cluster search head.

View the dashboard

Here's how the search head dashboard looks:

Search head dashboard bubbles.png

The dashboard lists the master nodes for all clusters the search head belongs to, along with some information on the status of each cluster.

For more information on the master node and its cluster, click the arrow at the far left of each row.

You can get information on the search head itself by selecting the More Info button on the upper right corner of the dashboard:

  • Name. The search head's serverName, as specified in its $SPLUNK_HOME/etc/system/local/server.conf file.

You can also perform a variety of edits and actions on the search head. These are described in the next section.

Perform edits and actions on the search head

Join another cluster

To connect the search head to another cluster, select the Add cluster to be searched button on the uppper right corner of the dashboard. To join the cluster, fill out the fields in the pop-up window:

  • Master IP address or Hostname. Enter the IP address or hostname of the master for the cluster you want to join. For example: https://10.152.31.202.
  • Master Port. Enter the master's management port. For example: 8089.
  • Security Key. This is the key that authenticates communication between the master and the peers and search heads. The key must be the same across all instances within a cluster. If the master has a security key, you must enter it here. The search head can use a different key for each cluster.

For more information on searching across multiple clusters, see "Configure multi-cluster search".

Remove the search head from a cluster

To remove the search head from a cluster, select the Remove Cluster action on the row for that cluster. This disassociates the search head from that cluster, but leaves it connected to all other clusters.

To remove the search head from all clusters, select Disable Clustering from the Edit menu on the upper right corner of the dashboard.

Change cluster configuration

To change the search head's configuration for a particular cluster, select the Edit Configuration action on the cluster's row. There are two main reasons for editing the configuration on a per-cluster basis:

  • Redirect the search head to another master for the same cluster. This can be useful in the case where a master fails but you have a stand-by master for that cluster which you can redirect the search head to. For more information on stand-by masters, see "Configure a stand-by master".
  • Change the search head's search key for the cluster. Only change the secret key if you are also changing it for all other nodes in the cluster. The key must be the same across all instances in a cluster.

Other edits

If you want to change this instance to some other node type, like a peer node, you can do so through the Edit button on the upper right of the dashboard.

Warning: It is extremely unlikely that you will want to change the node type for nodes in an active cluster. Consider the consequences carefully before doing so.

View information on search peers

You can also view information on the search peers (identical, in clustering, to the set of peer nodes) from the search head's Distributed Search page in Splunk Web:

1. On the search head, click Settings in the upper right corner of Splunk Web.

2. In the Distributed environment section, click Distributed search.

3. Click Search peers to view the set of search peers.

Warning: Do not use the Distributed Search page in Splunk Web to change your search head configuration or add peers. For information on how to configure a clustered search head correctly, see "Configure the search head".

PREVIOUS
View the peer dashboard
  NEXT
Update common peer configurations and apps

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters