Deployment Architecture

Search Head Clustering: How to test if work load and user sessions are being distributed across servers?

a212830
Champion

Hi,

I've setup SHC across a few servers. How do I test the following in Splunk:

1) User sessions are being distributed across the servers?
2) Work load is being distributed?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

1) Start a user session, maybe run a search... then kill the machine you were on. Get switched to another machine by your LB proxy, verify those search results, newly created dashboard, or whatever you were doing is there.

2) Schedule a bunch of expensive, frequently-run searches on one machine. See that all machines get busy, each search gets executed exactly once per intended run, that each alert action was triggered exactly once per intended triggering, and so on.

martin_mueller
SplunkTrust
SplunkTrust

You could run this:

| tstats count where index=_internal AND sourcetype=scheduler by _time host prestats=t | timechart count by host

That's not an accurate count of scheduled executions because it also counts "continued" events, but it's a good Q'n'D approximation that tells you if load is sent to multiple SHs or just one.

0 Karma

a212830
Champion

Where can I check that each server is getting busy? I don't want to login to each server individually.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...