Clustering and Advanced Administration

A cluster is a set of servers that are pooled together to work as one. Traditionally, the concept of a cluster is known to increase availability, fault tolerance, and efficiency. If one server fails, then the cluster reconfigures itself to ensure that the application is still available to users. For this to work, there must be a method of ensuring that data is shared between the individual cluster members or that there is some form of management or record keeping. There also needs to be a process in place to facilitate data recovery so that data fidelity can be maintained. We can configure search head and indexer clusters in Splunk to achieve all these advantages. In this chapter, we will discuss how search head and indexer clusters work and the components that make up each type of cluster. We will also look at a high-level overview of cluster configuration commands used to administer search head and indexer clusters. Finally, we’ll look...