Summary
This has been an interesting chapter on increasing Splunk fault tolerance and security. Splunk indexer and search head clusters give us the ability to increase the availability of data in the Splunk deployment. The search head cluster captain coordinates how configurations and knowledge objects are shared across cluster members. A functioning search cluster captain is important for the proper running of the search head cluster and Splunk has built-in processes for ensuring that the cluster can resume after any mishaps. An indexer cluster is managed by the cluster manager. We explored different scenarios where the state of the cluster is disturbed and looked at the steps that the cluster manager takes to remedy the situation. We got a high-level overview of how search head and indexer clusters are configured using CLI commands or by modifying the server.conf file.
In the next chapter, we will explore data models, acceleration, and other ways to improve performance.
