Deployment Architecture

Is there a way to ensure a report is run on a specific search head cluster member?

daniel333
Builder

All,

Is there a way to get a report to run on a specific member of a search head cluster? Mainly I want to know for sure which member has the outputcsv.

thanks
-Daniel

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Have you tried any of the solutions provided below?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Please refer to this post on a workaround to the fact that outputcsv results are not replicated in a SHC.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This may be a little over-reaching, but you can designate a member to run ad-hoc reports only, thus guaranteeing the report to run on the same SH each time

[shclustering]
adhoc_searchhead = true

https://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Adhocclustermember

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...