https://community.splunk.com/t5/Deployment-Architecture/distributed-search-Application-does-not-exist-search/m-p/97905#M3604 <P>One of the points of a distributed setup is the performance benefit of spreading the workload of searching over several indexers (indexers do a major part of work in searches). </P> <P>Also, this will let you use load balancing from the forwarders, which will give a higher resilience, since you can take one indexer down for maintenance, and events will still be forwarded to the other indexer.</P> <P>If you really want to have separate indexes on separate servers, and to limit where the searches are sent, I guess you could use the splunk_server=serverB search restriction, since Splunk does not inherently know on which indexer a certain index exists.</P> <P>Or... hmm.. perhaps that field (splunk_server) just filters incoming results from all indexers... in that case have a look at <CODE>localop</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Localop">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Localop</A></P> <P>/K </P> Wed, 17 Apr 2013 15:12:19 GMT kristian_kolb 2013-04-17T15:12:19Z https://community.splunk.com/t5/Deployment-Architecture/distributed-search-Application-does-not-exist-search/m-p/97904#M3603 <P>Hi,</P> <P>There are 2 splunk servers( A and B) that have differente data and indexes. I have setup distributed search from A to B and B to A.</P> <P>searches done from A to B: everything is working as expected. I search for an index that only exists in B and I get results.</P> <P>searches done from B to A: searches for indexes in A fail, and searches for local indexes give out warnings about searches in B failing.</P> <P>Looking through the search.log I see messages like <BR /> ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: search</P> <P>However the application exists in both splunk server. And why is every single search being replicated between both splunk servers. If I am looking for something in an index that is in B while I am connected to B is shouldn't replicate the search to A.</P> <P>I think I should be using clustering instead of distributed search as I plan on having different indexes and data on each of the splunk servers.</P> Wed, 17 Apr 2013 14:59:37 GMT https://community.splunk.com/t5/Deployment-Architecture/distributed-search-Application-does-not-exist-search/m-p/97904#M3603 krugger 2013-04-17T14:59:37Z https://community.splunk.com/t5/Deployment-Architecture/distributed-search-Application-does-not-exist-search/m-p/97905#M3604 <P>One of the points of a distributed setup is the performance benefit of spreading the workload of searching over several indexers (indexers do a major part of work in searches). </P> <P>Also, this will let you use load balancing from the forwarders, which will give a higher resilience, since you can take one indexer down for maintenance, and events will still be forwarded to the other indexer.</P> <P>If you really want to have separate indexes on separate servers, and to limit where the searches are sent, I guess you could use the splunk_server=serverB search restriction, since Splunk does not inherently know on which indexer a certain index exists.</P> <P>Or... hmm.. perhaps that field (splunk_server) just filters incoming results from all indexers... in that case have a look at <CODE>localop</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Localop">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Localop</A></P> <P>/K </P> Wed, 17 Apr 2013 15:12:19 GMT https://community.splunk.com/t5/Deployment-Architecture/distributed-search-Application-does-not-exist-search/m-p/97905#M3604 kristian_kolb 2013-04-17T15:12:19Z https://community.splunk.com/t5/Deployment-Architecture/distributed-search-Application-does-not-exist-search/m-p/97906#M3605 <P>I would have to edit all the searches on both server. They are like 300 of them, I will do if there is no other way</P> Wed, 17 Apr 2013 17:01:15 GMT https://community.splunk.com/t5/Deployment-Architecture/distributed-search-Application-does-not-exist-search/m-p/97906#M3605 krugger 2013-04-17T17:01:15Z