Search Head Cluster - Scheduled Search Running only in one instance

[ykpramodhcbt]

Hi All,

We have a search head cluster with 3 search heads along with a deployer. We have a scheduled search which runs a query every 8 hours and pushes the data to the "summary indexes". Though the search is scheduled on all the search heads (SH1, SH2, SH3), we observed that the summary index calculation is happening only in one of the search heads. Is this a default setting?

[harsmarvania57 · Accepted solution]

Hi @ykpramodhcbt,

When you schedule a search in Search Head Cluster, it will run only on 1 search head not all search heads. In Search Head Cluster, captain will decide(Baed on load on SH) on which SH scheduled search will run so it will be fine if is running on same server on daily basis.

Additionally also check whether you have configured to run ad-hoc searches only on 2 search heads based on this documentation? If so then 2 search heads will run ad-hoc searches only and only 1 search head will run schedule searches.

[harsmarvania57]

Hi @ykpramodhcbt,

Comment which I have provided helped you to figure out problem you are facing?

[ykpramodhcbt]

Hi, It is helpful.

Can you please let us know how we can figure out which search head picked up a scheduled search?

Currently we are running the following command on all seach heads -
$ cat splunkd.log | grep "searchname"

[harsmarvania57]

If you are forwarding your search head logs to indexer then you can use query index=_internal host=<Sead Heads> source=*scheduler.log* to find out which search ran on which search heads. I am not in front of my splunk instance otherwise I'll provide more accurate query.