Deployment Architecture

Search Head Cluster - Scheduled Search Running only in one instance

Path Finder

Hi All,

We have a search head cluster with 3 search heads along with a deployer. We have a scheduled search which runs a query every 8 hours and pushes the data to the "summary indexes". Though the search is scheduled on all the search heads (SH1, SH2, SH3), we observed that the summary index calculation is happening only in one of the search heads. Is this a default setting?

1 Solution

SplunkTrust
SplunkTrust

Hi @ykpramodhcbt,

When you schedule a search in Search Head Cluster, it will run only on 1 search head not all search heads. In Search Head Cluster, captain will decide(Baed on load on SH) on which SH scheduled search will run so it will be fine if is running on same server on daily basis.

Additionally also check whether you have configured to run ad-hoc searches only on 2 search heads based on this documentation? If so then 2 search heads will run ad-hoc searches only and only 1 search head will run schedule searches.

View solution in original post

SplunkTrust
SplunkTrust

Hi @ykpramodhcbt,

When you schedule a search in Search Head Cluster, it will run only on 1 search head not all search heads. In Search Head Cluster, captain will decide(Baed on load on SH) on which SH scheduled search will run so it will be fine if is running on same server on daily basis.

Additionally also check whether you have configured to run ad-hoc searches only on 2 search heads based on this documentation? If so then 2 search heads will run ad-hoc searches only and only 1 search head will run schedule searches.

View solution in original post

SplunkTrust
SplunkTrust

Hi @ykpramodhcbt,

Comment which I have provided helped you to figure out problem you are facing?

0 Karma

Path Finder

Hi, It is helpful.

Can you please let us know how we can figure out which search head picked up a scheduled search?

Currently we are running the following command on all seach heads -
$ cat splunkd.log | grep "searchname"

0 Karma

SplunkTrust
SplunkTrust

If you are forwarding your search head logs to indexer then you can use query index=_internal host=<Sead Heads> source=*scheduler.log* to find out which search ran on which search heads. I am not in front of my splunk instance otherwise I'll provide more accurate query.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!