https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168090#M6270 <P>You could run this:</P> <PRE><CODE>| tstats count where index=_internal AND sourcetype=scheduler by _time host prestats=t | timechart count by host </CODE></PRE> <P>That's not an accurate count of scheduled executions because it also counts "continued" events, but it's a good Q'n'D approximation that tells you if load is sent to multiple SHs or just one.</P> Sun, 21 Dec 2014 23:06:46 GMT martin_mueller 2014-12-21T23:06:46Z https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168087#M6267 <P>Hi,</P> <P>I've setup SHC across a few servers. How do I test the following in Splunk:</P> <P>1) User sessions are being distributed across the servers?<BR /> 2) Work load is being distributed?</P> Sat, 20 Dec 2014 12:43:33 GMT https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168087#M6267 a212830 2014-12-20T12:43:33Z https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168088#M6268 <P>1) Start a user session, maybe run a search... then kill the machine you were on. Get switched to another machine by your LB proxy, verify those search results, newly created dashboard, or whatever you were doing is there.</P> <P>2) Schedule a bunch of expensive, frequently-run searches on one machine. See that all machines get busy, each search gets executed exactly once per intended run, that each alert action was triggered exactly once per intended triggering, and so on.</P> Sun, 21 Dec 2014 16:26:11 GMT https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168088#M6268 martin_mueller 2014-12-21T16:26:11Z https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168089#M6269 <P>Where can I check that each server is getting busy? I don't want to login to each server individually. </P> Sun, 21 Dec 2014 19:25:32 GMT https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168089#M6269 a212830 2014-12-21T19:25:32Z https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168090#M6270 <P>You could run this:</P> <PRE><CODE>| tstats count where index=_internal AND sourcetype=scheduler by _time host prestats=t | timechart count by host </CODE></PRE> <P>That's not an accurate count of scheduled executions because it also counts "continued" events, but it's a good Q'n'D approximation that tells you if load is sent to multiple SHs or just one.</P> Sun, 21 Dec 2014 23:06:46 GMT https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Clustering-How-to-test-if-work-load-and-user/m-p/168090#M6270 martin_mueller 2014-12-21T23:06:46Z