Distributed Search Peer Restart

[ephemeric]

Greetz,

Is it possible to stop/start or restart a search peer while it is handling a search request
from a search head and have the search still complete?

Is there any way to signal to the head to "hold on" or something?

Do I assume the distsearch continues over the available splunk_servers
but results will be incomplete from the restarted peer?

Thanks.

[pete42]

Correct, if a search peer goes offline you have a distinct possibility that your result set will be incomplete. If you only have a few indexers, you could monitor how many searches are running and restart when the system is quiet. Unfortunately if you have as many saved scheduled searches as I do, that is never. Hope this helps.