Master configuration overview
You initially configure the master when you enable it, as described in "Enable the master node". This is usually all the configuration the master needs.
Change the configuration
If you need to edit the configuration, you have these choices:
- You can edit the configuration from the master node dashboard in Splunk Web. See "Configure the master with the dashboard".
- You can directly edit the
[clustering]
stanza in the master'sserver.conf
file. To configure some advanced settings, you must edit this file. See "Configure the master with server.conf".
- You can use the CLI. See "Configure the master with the CLI".
After you change the master configuration, you must restart the master for the changes to take effect.
Important: The master has the sole function of managing the other cluster nodes. Do not use it to index external data or to search the cluster.
Changes that require caution
Be careful when making changes to these settings:
- Replication factor and search factor. It is inadvisable to increase either of these settings after your indexer cluster contains significant amounts of data. This will kick off a great deal of bucket activity, affecting the cluster's performance adversely while bucket copies are being created or made searchable.
- Heartbeat timeout. Do not change the
heartbeat_timeout
attribute from its default value of 60 (seconds) unless instructed to do so by Splunk Support. In particular, do not decrease it. This can overload the peers.
Configure a stand-by master
To prepare for master node failure, configure a stand-by master that can take over if the current master goes down. See "Replace the master node on the indexer cluster".
Configure a multisite master
A multisite master has a number of configuration differences and additions, compared to a basic, single-site cluster. See "Configure multisite indexer clusters with server.conf".
Configure and manage the indexer cluster with the CLI | Configure the master with the dashboard |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Feedback submitted, thanks!