Deployment Architecture

Is there a way to ensure a report is run on a specific search head cluster member?

daniel333
Builder

All,

Is there a way to get a report to run on a specific member of a search head cluster? Mainly I want to know for sure which member has the outputcsv.

thanks
-Daniel

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Have you tried any of the solutions provided below?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Please refer to this post on a workaround to the fact that outputcsv results are not replicated in a SHC.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This may be a little over-reaching, but you can designate a member to run ad-hoc reports only, thus guaranteeing the report to run on the same SH each time

[shclustering]
adhoc_searchhead = true

https://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Adhocclustermember

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...