Use the CLI to view information about a search head cluster

A number of CLI commands provide status information on the search head cluster.

Show cluster status

To check the overall status of your search head cluster, run this command from any member:

splunk show shcluster-status -auth <username>:<password>

The command returns basic information on the captain and the cluster members. Key information that it provides includes:

(Captain section.) The dynamic_captain field indicates whether the cluster uses a dynamic captain. A value of 1 specifies a dynamic captain.
(Captain section.) The id field specifies the cluster GUID. This GUID is different from the GUID of any cluster members, including the captain.
(Captain section.) The label field specifies the cluster label. The monitoring console uses the label identifier.
(Each member's section.) The status field specifies the status of each member, such as up, down, detention, restarting. Some status values require clarification:

Detention. A cluster member enters detention when it runs out of disk space. While in detention, the captain will not assign scheduled searches or artifact copies to it. To remediate, you must increase the disk space available to the instance.
Down. When a member leaves the cluster, because of some failure or because you remove it from the cluster, it enters the down state.
Pending. This indicates that the member is attempting to rejoin the cluster. This is a transitional state. The status changes to Up when the member successfully rejoins the cluster.

(Each member's section.) The last_conf_replication field indicates when the member last pulled a set of configurations from the captain. See View replication status.

To check the configuration of a cluster member, run this command on the member itself:

splunk list shcluster-config -auth <username>:<password>

Alternatively, you can run this variant on another member:

splunk list shcluster-config -uri <URI>:<management_port> -auth <username>:<password>

Note the following:

The -uri parameter specifies the URI and management port for the member whose configuration you want to check.

To get a list of all cluster members, run this command from any member:

splunk list shcluster-members -auth <username>:<password>

This command returns all members of the cluster, along with their configurations.

Note: The command continues to list members that have left the cluster until captaincy transfers.

To list information about a member, run this command on the member itself:

splunk list shcluster-member-info -auth <username>:<password>

Alternatively, you can run this variant on another member:

splunk list shcluster-member-info -uri <URI>:<management_port> -auth <username>:<password>

Note the following:

The -uri parameter specifies the URI and management port for the member whose configuration you want to know.

To list the set of artifacts stored on the cluster, run this command on the captain:

splunk list shcluster-artifacts

To list the set of artifacts stored on a particular member, run this command on the member itself:

splunk list shcluster-member-artifacts

To list the set of scheduler jobs, run this command on the captain:

splunk list shcluster-scheduler-jobs -auth <username>:<password>