https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75815#M19164 <P>Whichever search head happens to acquire a lock on a job instance first, they'll run it. So, no, there isn't a lot of intelligence behind it. If a machine is running slower (and assuming clocks are all in sync), then it will be slightly less likely to pick up a job, but that's about it.</P> Wed, 14 Sep 2011 22:51:41 GMT gkanapathy 2011-09-14T22:51:41Z https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75814#M19163 <P>i like the idea of search head pooling with respect to ease of managing configs across multiple search heads. but i'm a little confused as to how scheduled searches are divvied between the search heads in the pool. is there any logic behind it? will it work intelligently if i have non-homogeneous HW for my search heads?</P> Wed, 14 Sep 2011 22:18:09 GMT https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75814#M19163 tpsplunk 2011-09-14T22:18:09Z https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75815#M19164 <P>Whichever search head happens to acquire a lock on a job instance first, they'll run it. So, no, there isn't a lot of intelligence behind it. If a machine is running slower (and assuming clocks are all in sync), then it will be slightly less likely to pick up a job, but that's about it.</P> Wed, 14 Sep 2011 22:51:41 GMT https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75815#M19164 gkanapathy 2011-09-14T22:51:41Z https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75816#M19165 <P>are there any plans on the roadmap to set or influence which search head(s) in the search head pool run scheduled searches? I'd like to do this so i can have search head dedicated for ad-hoc searches and others for scheduled searches and still get the ease of maintenance you get with pooling search heads.</P> Wed, 14 Sep 2011 23:54:31 GMT https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75816#M19165 tpsplunk 2011-09-14T23:54:31Z https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75817#M19166 <P>We have 5 seachheads in our pool. 1 is dedicated to running scheduled searches. The others do NOT run scheduled searches. On the searchheads that you DON'T want to run scheduled searches, in .../splunk/etc/system/local in default-mode.conf add:<BR /> [pipeline:scheduler]<BR /> disabled = true</P> <P>We had to do this locally on each searchhead because "disabled=false" doesn't work.</P> <P>Basically you are setting up a single server as a Splunk jobs server.</P> Thu, 17 May 2012 12:59:52 GMT https://community.splunk.com/t5/Splunk-Search/how-does-search-head-pooling-work-with-scheduled-searches/m-p/75817#M19166 rmorlen 2012-05-17T12:59:52Z