Schedule a saved search to run a designated Search Head

[shangshin]

Hi,
Assuming I have 4 search heads (A, B, C, D) on a cluster env. Is it possible to schedule a saved search to run a designated search head? Another to put this -- how can I make the scheduled saved search to run on search head C all the time?

Thanks in advance!

[tsteens]

Hi,

Very late answer and you probably has this figured out by now. Anyway, I put it here for reference.

You can configure all the other search heads to only run ad hoc searches.
In server.conf add the following:

[shclustering]
adhoc_searchhead = true

Ref: https://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/Adhocclustermember