topic Re: Partial search head pooling in Deployment Architecture

Partial search head pooling

nocostk — Tue, 19 Apr 2011 19:52:44 GMT

I have a two search heads - but they perform different tasks. One head is for running scheduled searches and the other is for interactive searches. I'd like to utilize search head pooling - but I don't want to share any of the savedsearches.conf files. Is this possible?

Re: Partial search head pooling

msettipane — Tue, 19 Apr 2011 21:29:39 GMT

Search Head Pooling (SHP) is an all or nothing option at the moment. Once you enable it (splunk pooling enable ), it uses your SHP path for the "users" and "apps" folder.

However, since your users will not be logging into the other Search Head (Job Server) there should be no saved searches on that server to push to the SHP.

If you are using it for two distinctly different purposes, what reasons do you have for enabling SHP?

Re: Partial search head pooling

nocostk — Wed, 20 Apr 2011 12:28:52 GMT

I'd like to use SHP as a means of keeping my eventtypes.conf and tags.conf in sync. Sometimes it's a bit tiresome to continually ask developers to create their tags/eventtypes in both locations. If someone has any other ideas I'm all ears.

Re: Partial search head pooling

msettipane — Wed, 20 Apr 2011 14:00:46 GMT

Are there any road blocks that keep you from setting up SHP? What is the reason for not wanting saved searches on both servers?

Re: Partial search head pooling

hdre — Thu, 30 Aug 2012 21:38:22 GMT

This is probably not a supported way of handling this but we hacked this behavior by shutting off the scheduler search processor for the interactive search head and pooling with another search head that was left as the "job server". This job server would pick up and run scheduled searches while the interactive server could still be used to schedule searches. Not a perfect solution and there are other issues like trying to change scheduled search run times from the interactive search head.

See
.../etc/modules/internal/scheduler/config.xml

Re: Partial search head pooling

gkanapathy — Fri, 31 Aug 2012 00:19:35 GMT

There is a better way to do this. See my answer.

Re: Partial search head pooling

gkanapathy — Fri, 31 Aug 2012 00:22:40 GMT

You can't "partially" pool. however, you can disable the scheduler on the one that isn't supposed to run jobs. @hdre did this, but did this in a dangerous way. The right way to do this is to stick this in default-mode.conf:

[pipeline:scheduler]
disabled_processors = LiveSplunks

This does the same thing as hdre suggested, but more safely (e.g., it won't get overwritten on a patch or upgrade).