SPLK-2002: Splunk Enterprise Certified ArchitectDemo

Question

An administrator removed and then re-added search head cluster (SHC) members while patching the operating system. When attempting to re-add the first member, a script restored that SHC member to an earlier backup, and it now refuses to join the cluster.

What is the best way to repair the member so it can rejoin?

A Force the member add by running splunk edit shcluster-config --force.
B Review splunkd.log for configuration changes preventing the addition of the member.
C Clean the Raft metadata using splunk clean raft.
D Delete the [shclustering] stanza in server.conf and restart Splunk.

Explanation

A restored SHC member can retain stale or corrupted Raft metadata that no longer matches the active cluster. Running splunk clean raft on that member clears its local Raft state; after it is restarted, the member repopulates that state from the cluster captain and can rejoin.

Learn more

Handle Raft issues | Splunk Enterprise

SPLK-2002: Splunk Enterprise Certified ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ42

Community Discussion