Deployment Architecture

Search Head Cluster - Scheduled Search Running only in one instance

ykpramodhcbt
Path Finder

Hi All,

We have a search head cluster with 3 search heads along with a deployer. We have a scheduled search which runs a query every 8 hours and pushes the data to the "summary indexes". Though the search is scheduled on all the search heads (SH1, SH2, SH3), we observed that the summary index calculation is happening only in one of the search heads. Is this a default setting?

1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @ykpramodhcbt,

When you schedule a search in Search Head Cluster, it will run only on 1 search head not all search heads. In Search Head Cluster, captain will decide(Baed on load on SH) on which SH scheduled search will run so it will be fine if is running on same server on daily basis.

Additionally also check whether you have configured to run ad-hoc searches only on 2 search heads based on this documentation? If so then 2 search heads will run ad-hoc searches only and only 1 search head will run schedule searches.

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi @ykpramodhcbt,

When you schedule a search in Search Head Cluster, it will run only on 1 search head not all search heads. In Search Head Cluster, captain will decide(Baed on load on SH) on which SH scheduled search will run so it will be fine if is running on same server on daily basis.

Additionally also check whether you have configured to run ad-hoc searches only on 2 search heads based on this documentation? If so then 2 search heads will run ad-hoc searches only and only 1 search head will run schedule searches.

harsmarvania57
SplunkTrust
SplunkTrust

Hi @ykpramodhcbt,

Comment which I have provided helped you to figure out problem you are facing?

0 Karma

ykpramodhcbt
Path Finder

Hi, It is helpful.

Can you please let us know how we can figure out which search head picked up a scheduled search?

Currently we are running the following command on all seach heads -
$ cat splunkd.log | grep "searchname"

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

If you are forwarding your search head logs to indexer then you can use query index=_internal host=<Sead Heads> source=*scheduler.log* to find out which search ran on which search heads. I am not in front of my splunk instance otherwise I'll provide more accurate query.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...