Search Head Cluster Health and Troubleshooting

Diagnose Search Head Cluster state from supplied or safely collected read-only evidence. Keep observations, documented expectations, hypotheses, owners, and unavailable facts separate. This skill is strictly advisory: it never changes captaincy or membership, restarts or rolls members, toggles detention or maintenance, applies a deployer bundle, repairs or restores KV Store, changes configuration, runs SPL, opens a ticket, or claims an unevidenced recovery.

When to Use

Use this skill to:

• assess current captain identity, stability, election chronology, majority- relevant evidence, or Raft symptoms;
• compare captain and member views of registration, heartbeat, participation, service readiness, detention, rolling state, and version;
• interpret SHC configuration replication, search-artifact replication, scheduler delegation, and cluster-caused search availability;
• assess member drift in replicated configuration, apps, roles, lookups, generation, or effective state when it is evidence of SHC health;
• assess KV Store service, replica, synchronization, read-only, backup, restore, and consumer-impact evidence without performing recovery;
• locate a deployer bundle problem among source, staging, validation or readiness, push initiation, distribution, receipt, application, restart requirement, and effective readback;
• decide whether current SHC health is ready, not ready, or decision-blocked for separately authorized rolling work; or
• produce an SHC-specific evidence request and owner or Support handoff.

Route only the portion that crosses the boundary:

• CMC or Monitoring Console navigation, health reports, health.log, diag or RapidDiag planning, minimization, redaction, collection, and normalized packets -> splunk-health-monitoring-and-diagnostic-collection; this skill supplies SHC-specific fields and interprets the resulting packet;
• broad service crashes, host or operating-system failure, CPU or memory, filesystem pressure, network incidents, ingestion outages, or active remediation -> splunk-platform-operations-advisor; retain the SHC-specific finding and stop evidence here;
• broad knowledge-object inventory, ownership, ACLs, sharing, orphan cleanup, or hygiene -> knowledge-object-governance; retain only SHC replication or member-drift evidence here;
• app packaging, AppInspect, compatibility, install, upgrade, migration, or removal -> app-and-add-on-lifecycle-advisor; retain only deployer and member health phases here;
• upgrade path, target-version prerequisites, topology sequence, backup and recovery plan, maintenance-window plan, or upgrade go/no-go -> upgrade-planning-and-execution-readiness; this skill provides the current SHC-health readiness input;
• SPL authoring or execution -> splunk-search; one functional search's performance or workload tuning -> search-performance-optimizer; retain cluster-caused dispatch, scheduler, artifact, and availability evidence here;
• indexer manager or peer state, replication or search factors, buckets, fix-up, indexer configuration bundles, multisite, or SmartStore -> indexer-cluster-health-and-troubleshooting; and
• federated-provider connectivity, identity, load-balancer, endpoint, mail, certificate, or application behavior -> the directly accountable owner, while retaining only the demonstrated SHC interaction here.

Do not turn a broad symptom into an SHC diagnosis. Give the supported first finding, then request the smallest SHC-specific artifact that can establish whether this skill owns the next decision.