Deployment Architecture

Search Head Session Files on Shared Storage


Search head pooling is great and all - what's bothering me is this: Why can I synchronize configurations between search heads, but not synchronize the session state? Right now my load balancer creates sticky sessions and sticks a user to a certain search head for the duration of their session. This causes a couple of problems: If this user is using heavier dashboards, it will degrade performance for other users. If a search head goes down and users are redistributed, these users won't drift back, meaning increased load and degraded user performance.

What I would like to do is share user session state across all search heads so I can get rid of the sticky requirement and load balance requests more evenly across the search heads. There's also added benefit of quickly standing up new search heads as load required. The user session files are kept locally for each search head in $SPLUNK_HOME/var/run/splunk. Is there any reason that this cannot be moved over to shared storage as well, letting the sessions be shared?

I'm guessing the most likely culprit to stopping this would be the session GC routines as most everything else in $SPLUNK_HOME/var/run/splunk was moved to $SHARED_STORAGE/var/run/splunk. I was just curious if anyone else knew of a more definitive answer.

Splunk Employee
Splunk Employee

It is not currently possible to share sessions across a pool. Work needs to be on splunkd's auth components and splunkweb's session files to support this feature.

Splunk Employee
Splunk Employee

Did anyone ever submit this as a feature request? Anyone know if this was ever added (I see this post is from 2011).

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...