Back to Floor
The Search Network • Room 3
Search Head Clustering
Search Head Clustering (SHC) groups multiple search heads that share configurations, saved searches, dashboards, and user data. This provides high availability and load balancing for the search tier.
SHC uses a Captain — a dynamically elected leader that coordinates replication and artifact synchronization. If the Captain fails, a new one is elected automatically.
A Deployer pushes app and configuration updates to all SHC members. Unlike regular deployment server, the Deployer uses the shcluster/apps/ directory.
SHC member status
./splunk show shcluster-status
Captain: sh1.company.com
Members: 3
Dynamic Captain: trueKnowledge Check
Prove your understanding to clear the room (Rewards XP)
Question 1 of 2
What role does the Captain serve in SHC?