topic Re: Search Head Cluster - Scheduled Search Running only in one instance in Deployment Architecture

Search Head Cluster - Scheduled Search Running only in one instance

ykpramodhcbt — Fri, 01 Dec 2017 13:09:48 GMT

Hi All,

We have a search head cluster with 3 search heads along with a deployer. We have a scheduled search which runs a query every 8 hours and pushes the data to the "summary indexes". Though the search is scheduled on all the search heads (SH1, SH2, SH3), we observed that the summary index calculation is happening only in one of the search heads. Is this a default setting?

Re: Search Head Cluster - Scheduled Search Running only in one instance

harsmarvania57 — Fri, 01 Dec 2017 13:17:25 GMT

Hi @ykpramodhcbt,

When you schedule a search in Search Head Cluster, it will run only on 1 search head not all search heads. In Search Head Cluster, captain will decide(Baed on load on SH) on which SH scheduled search will run so it will be fine if is running on same server on daily basis.

Additionally also check whether you have configured to run ad-hoc searches only on 2 search heads based on this documentation? If so then 2 search heads will run ad-hoc searches only and only 1 search head will run schedule searches.

Re: Search Head Cluster - Scheduled Search Running only in one instance

harsmarvania57 — Mon, 04 Dec 2017 14:51:53 GMT

Hi @ykpramodhcbt,

Comment which I have provided helped you to figure out problem you are facing?

Re: Search Head Cluster - Scheduled Search Running only in one instance

ykpramodhcbt — Tue, 05 Dec 2017 05:39:20 GMT

Hi, It is helpful.

Can you please let us know how we can figure out which search head picked up a scheduled search?

Currently we are running the following command on all seach heads -
$ cat splunkd.log | grep "searchname"

Re: Search Head Cluster - Scheduled Search Running only in one instance

harsmarvania57 — Tue, 05 Dec 2017 05:51:23 GMT

If you are forwarding your search head logs to indexer then you can use query index=_internal host=<Sead Heads> source=*scheduler.log* to find out which search ran on which search heads. I am not in front of my splunk instance otherwise I'll provide more accurate query.