Deployment Architecture

Search Head Session Files on Shared Storage

mikehayman
Engager

Search head pooling is great and all - what's bothering me is this: Why can I synchronize configurations between search heads, but not synchronize the session state? Right now my load balancer creates sticky sessions and sticks a user to a certain search head for the duration of their session. This causes a couple of problems: If this user is using heavier dashboards, it will degrade performance for other users. If a search head goes down and users are redistributed, these users won't drift back, meaning increased load and degraded user performance.

What I would like to do is share user session state across all search heads so I can get rid of the sticky requirement and load balance requests more evenly across the search heads. There's also added benefit of quickly standing up new search heads as load required. The user session files are kept locally for each search head in $SPLUNK_HOME/var/run/splunk. Is there any reason that this cannot be moved over to shared storage as well, letting the sessions be shared?

I'm guessing the most likely culprit to stopping this would be the session GC routines as most everything else in $SPLUNK_HOME/var/run/splunk was moved to $SHARED_STORAGE/var/run/splunk. I was just curious if anyone else knew of a more definitive answer.

ewoo
Splunk Employee
Splunk Employee

It is not currently possible to share sessions across a pool. Work needs to be on splunkd's auth components and splunkweb's session files to support this feature.

sloshburch
Splunk Employee
Splunk Employee

Did anyone ever submit this as a feature request? Anyone know if this was ever added (I see this post is from 2011).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...