topic Re: Help with Interview prep in Getting Data In

Help with Interview prep

alexlexxy — Tue, 26 Oct 2021 03:56:18 GMT

Describe what happens when an adhoc search is issued on a search head in a distributed environment?

Does the search head communicate with the cluster master or directly with the indexers? Im looking for clarifications.

Re: Help with Interview prep

venkatasri — Tue, 26 Oct 2021 04:33:17 GMT

@alexlexxy SH does communicate with cluster master before finding out which peers to fetch results.

more detailed notes here,

https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Howclusteredsearchworks#Search_across_a_single-site_cluster

Re: Help with Interview prep

alexlexxy — Tue, 26 Oct 2021 04:38:52 GMT

@venkatasri thank you for the response, however, I was just wondering what will happen if the cluster master goes down, will the SH be able to return results of an adhoc search?

Re: Help with Interview prep

venkatasri — Tue, 26 Oct 2021 04:51:10 GMT

@alexlexxy

explained here don't want to re-write. 🙂

https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Whathappenswhenamanagernodegoesdown#When_a_manager_goes_down

Re: Help with Interview prep

alexlexxy — Tue, 26 Oct 2021 04:52:32 GMT

Totally! thank you.