Splunk® Enterprise

Distributed Search

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Use the CLI to view information about a search head cluster

A number of CLI commands provide status information on the search head cluster.

You can also use the monitoring console to get more information about the cluster. See "Use the monitoring console to view search head cluster status and troubleshoot issues."

Show cluster status

To check the overall status of your search head cluster, run this command from any member:

splunk show shcluster-status -auth <username>:<password>

The command returns basic information on the captain and the cluster members. Key information that it provides includes:

  • (Captain section.) The dynamic_captain field indicates whether the cluster uses a dynamic captain. A value of 1 specifies a dynamic captain.
  • (Captain section.) The id field specifies the cluster GUID. This GUID is different from the GUID of any cluster members, including the captain.
  • (Captain section.) The label field specifies the cluster label. The monitoring console uses the label identifier.
  • (Each member's section.) The status field specifies the status of each member: up, down, detention, restarting. The following status values require clarification:
  • Detention. A cluster member enters detention when it runs out of disk space. While in detention, the captain will not assign scheduled searches or artifact copies to it. To remediate, you must increase the disk space available to the instance.
  • Down. When a member leaves the cluster, because of some failure or because you remove it from the cluster, it enters the down state. The captain notes this and reports the member's status as "down" when you run this command. However, if captaincy then transfers, the new captain does not have any record of the member leaving the cluster. When you run this command on the new captain, it does not return any information about the downed member.
  • Pending. This indicates that the member is attempting to rejoin the cluster. This is a transitional state. The status changes to Up when the member successfully rejoins the cluster.
  • (Each member's section.) The last_conf_replication field indicates when the member last pulled a set of configurations from the captain. See View replication status.

Show member configuration

To check the configuration of a cluster member, run this command on the member itself:

splunk list shcluster-config -auth <username>:<password>

Alternatively, you can run this variant on another member:

splunk list shcluster-config -uri <URI>:<management_port> -auth <username>:<password>

Note the following:

  • The -uri parameter specifies the URI and management port for the member whose configuration you want to check.

List cluster members

To get a list of all cluster members, run this command from any member:

splunk list shcluster-members -auth <username>:<password>

This command returns all members of the cluster, along with their configurations.

Note: The command continues to list members that have left the cluster until captaincy transfers.

List member information

To list information about a member, run this command on the member itself:

splunk list shcluster-member-info -auth <username>:<password>

Alternatively, you can run this variant on another member:

splunk list shcluster-member-info -uri <URI>:<management_port> -auth <username>:<password>

Note the following:

  • The -uri parameter specifies the URI and management port for the member whose configuration you want to know.

List search artifacts

To list the set of artifacts stored on the cluster, run this command on the captain:

splunk list shcluster-artifacts

To list the set of artifacts stored on a particular member, run this command on the member itself:

splunk list shcluster-member-artifacts

List scheduler jobs

To list the set of scheduler jobs, run this command on the captain:

splunk list shcluster-scheduler-jobs -auth <username>:<password>
PREVIOUS
Restart the search head cluster
  NEXT
Use the monitoring console to view search head cluster status and troubleshoot issues

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters