Deployment Architecture

How do I avoid redundancy for a script running in a search head cluster?

charleswheelus2
Engager

Hi,

We are currently running an alarming python script on our main search head that sends an email when less data is received than expected.

We are moving to a searchhead cluster. How do I make sure the script runs once, from a live search head, without manual intervention?

Do I copy it to all 3 search heads? Will it send me 3 emails? I want to avoid this.

Thanls

0 Karma

skoelpin
SplunkTrust
SplunkTrust

The search head captain will designate a search head to run the search and execute the script upon a triggering condition. So the script will run once on the search head member which was designated to run the search

In a search head cluster, you use the deployer to deploy configurations to the search head members. They need to be in sync with each other, so its important that you don't add configs to the search head directly. Lastly, scripts have been deprecated from Splunk so you should really look into alert actions which can fire a script.

https://docs.splunk.com/Documentation/Splunk/7.0.2/DistSearch/SHCdeploymentoverview

https://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...