Deployment Architecture

Distributed Search Peer Restart



Is it possible to stop/start or restart a search peer while it is handling a search request
from a search head and have the search still complete?

Is there any way to signal to the head to "hold on" or something?

Do I assume the distsearch continues over the available splunk_servers
but results will be incomplete from the restarted peer?


0 Karma

Re: Distributed Search Peer Restart

New Member

Correct, if a search peer goes offline you have a distinct possibility that your result set will be incomplete. If you only have a few indexers, you could monitor how many searches are running and restart when the system is quiet. Unfortunately if you have as many saved scheduled searches as I do, that is never. Hope this helps.

0 Karma