Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Configure the master with the dashboard

You can edit the configuration of an existing master node through its dashboard:

  1. In Splunk Web, click Settings > Indexer clustering.
    The Master Node dashboard appears.
  2. Select the Edit button on the upper right side of the dashboard.
    The Edit button presents several options:
    • Node Type. Change the instance's node type. Caution: It is extremely unlikely that you will want to change the node type for nodes in an active cluster. Consider the consequences carefully before doing so.
    • Master Node Configuration. Change these master node settings:
      • Replication Factor. Change the cluster's replication factor. Caution: It is inadvisable to increase the replication factor after your cluster contains significant amounts of data. Doing so will kick off a great deal of bucket activity, which will have an adverse effect on the cluster's performance while bucket copies are being created.
      • Search Factor. Change the cluster's search factor. Caution: It is inadvisable to increase the search factor after your cluster contains significant amounts of data. Doing so will kick off a great deal of bucket activity, which will have an adverse effect on the cluster's performance while bucket copies are being made searchable.
      • Security Key. Change the security key. Only change the security key if you are also changing it for all other nodes in the cluster. The key must be the same across all instances in a cluster.
      • Cluster Label. Label the cluster. The label is useful for identifying the cluster in the monitoring console. See Set cluster labels in Securing Splunk Enterprise.

        The Master Node Configuration option is disabled for multisite clusters.

    • Configuration Bundle Actions. Click Push to distribute the configuration bundle from the master node to peer nodes. Optionally, validate the bundle and check restart without applying the bundle, or rollback to the previous bundle. See Update common peer configurations and apps.
    • Data Rebalance. Rebalance the buckets so that each peer has approximately the same number of bucket copies. See Rebalance the indexer cluster.
    • Disable Indexer Clustering. Remove this node from the cluster. Caution: If you remove the master node from the cluster, the entire cluster will eventually fail.

For information on using this dashboard to enable a master node initially, see Enable the indexer cluster master node.

For information on using this dashboard to view cluster status, see View the master dashboard.

Last modified on 15 September, 2020
Master configuration overview   Configure the master with server.conf

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters