A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X,Y). During a search executed on search head X, indexer A crashes. What is Splunk’s response?
A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X,Y). During a search executed on search head X, indexer A crashes. What is Splunk’s response?
When an indexer crashes during a search in a non-clustered Splunk environment, Splunk updates the user in Splunk web informing them that the results of their search may be incomplete. Non-clustered environments do not offer automatic search retries or continuity mechanisms without manual intervention.
Splunk does not re-attempt searches on its own and changing the SH makes no sense if the Idx has not been recovered.