topic How SPL queries work in a distributed environment? in Splunk Search

How SPL queries work in a distributed environment?

NightShark — Wed, 03 Aug 2022 14:57:20 GMT

Hello Splunkers,

I was wondering if there is a Splunk documentation or an article about how certain search commands behave in a distributed environment. (i.e. mainly the usage of Join, Stats, Lookup, Sub Searches, Map, Transaction, Tstats etc.)

Descriptions could include about which Splunk node the command first runs, if it goes back and forth between Search Head and Indexer for example or does it only run in one of either. I know how these commands shape and filter certain logs, I just have not fully grasped how Commands are run in the background.

All help and comments are appreciated,

Thanks,

Regards,

Re: How SPL Queries work in a Distributed Enviroment

gcusello — Wed, 03 Aug 2022 08:32:59 GMT

Hi @NightShark,

always remember that the only problem on Splunk documentation is that it's usually too much!

Use Google search to find documentation, so you can find many docs, e.g. this https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Whatisdistributedsearch

If instead you want to better know Splunk Commands I hint to use the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial that describes how command works.

In few words:

searches are executed on Search Heads that send requests to Indexers.

Indexers give baks results to SH that take the useful ones (if you have a cluster with replicated data) and display them.

Filters are inserted in the search criteria in SH and applied in IDXs

Ciao.

Giuseppe

Re: How SPL Queries work in a Distributed Enviroment

NightShark — Wed, 03 Aug 2022 09:01:25 GMT

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

Re: How SPL Queries work in a Distributed Enviroment

gcusello — Wed, 03 Aug 2022 09:06:39 GMT

Hi @NightShark,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉