topic Re: How to di get a list of Search Heads in my Splunk Environment. in Deployment Architecture

How to get a list of search heads in my Splunk environment?

GeoCouloute — Thu, 06 Jul 2023 13:46:25 GMT

Hi,

I am relatively new to Splunk and I would like to know how to find out what are the number of "Search Heads" on my Splunk environment. I am sure there is a query that will display t his information. Any assistance on how to accomplish this would be a great help. I look forward to your response.

Re: How to di get a list of Search Heads in my Splunk Environment.

jowenssi — Tue, 12 Jun 2018 19:49:26 GMT

The easiest/quickest way would be to identify the instances running a Job Scheduler. Depending on the configuration of the distributed environment, this could return Indexers or instances with other Splunk roles that run jobs. This query also assumes that all of your logs are being forwarded to the Indexers.

index=_internal sourcetype=scheduler

You could then run this REST search on the instances to identify if the Splunk role is set as a Search Head:

| rest splunk_server=local /services/server/info | table serverName server_roles

Re: How to di get a list of Search Heads in my Splunk Environment.

ddrillic — Tue, 12 Jun 2018 19:49:34 GMT

If you have access to the Monitoring Console, it would show you the Search Heads, Indexers and more....

Re: How to di get a list of Search Heads in my Splunk Environment.

jowenssi — Tue, 12 Jun 2018 19:51:34 GMT

This is true, but only if the environment is configured correctly. The rest call below will display the same role information.

Re: How to di get a list of Search Heads in my Splunk Environment.

PowerPacked — Tue, 12 Jun 2018 20:03:39 GMT

Hi @GeoCouloute

if you have newer version of splunk 7.1.1
you can see a new option in settings --- search head clustering -- from there you can see the list of all search heads in the cluster.

from CLI you can also execute the query ./splunk show shcluster-status --- to see the list of all search heads incuding the captain in the cluster.

Thanks

Re: How to di get a list of Search Heads in my Splunk Environment.

gerrysr6 — Wed, 05 Jul 2023 16:04:56 GMT

I tried both commands and they return different servers.

The first command seems to return indexers (don't care) the second command lists one server and it's roles, which includes search_head (good).

Why would I care about schedulers? Are you saying the scheduler might also be the search head?

Re: How to di get a list of Search Heads in my Splunk Environment.

isoutamo — Thu, 06 Jul 2023 09:59:13 GMT

to getting REST queries to work, all those servers must be defined as search peer to this instance. Usually you define only indexers as a peer for SH so that's reason you are not founding other SHs with it except on MC where you already have added those to be a peer to get REST API and MC working correctly.

Scheduler is running on full splunk instances where are some search activities. This means at least SH and IDX and CM. Maybe also some HF could match to this and LM, DS and Deployer (cannot check it now). Easy way to drop IDXs away from that list (if you have only one IDX cluster/indexer where you send your internal logs) is

If you have serveral IDXc + indexers connected to this SH then you need add some other indexes here to get full list of splunk_servers where events are stored.

r. Ism