Deployment Architecture

Search head - Search peer communication direction in distributed enviroment

tdubicz
Engager

Hi all,

I have a simple question:
In a distributed environment (without SH cluster), what happens when I do a distributed search?

As I understand the SH opens a connection to the search peer(s), send it/them the search bundle, the search peer(s) execute(s) the search, but then what happens?
The search results send back to the SH trough the same connection (what initiate the SH earlier) or the search peer(s) initiate(s) a new connection?

In nutshell my question is:
In a distributed environment during a distributed search from its start to its end, Do exist only SH->search peer communication direction or not?

Thanks in advance!
Tamas

0 Karma
1 Solution

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

tdubicz
Engager

Thank You kindly, sir! 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...