Deployment Architecture

Schedule a saved search to run a designated Search Head

shangshin
Contributor

Hi,
Assuming I have 4 search heads (A, B, C, D) on a cluster env. Is it possible to schedule a saved search to run a designated search head? Another to put this -- how can I make the scheduled saved search to run on search head C all the time?

Thanks in advance!

Tags (2)
0 Karma

tsteens
Explorer

Hi,

Very late answer and you probably has this figured out by now. Anyway, I put it here for reference.

You can configure all the other search heads to only run ad hoc searches.
In server.conf add the following:

[shclustering]
adhoc_searchhead = true

Ref: https://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/Adhocclustermember

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...