Deployment Architecture

Search head - Search peer communication direction in distributed enviroment

tdubicz
Engager

Hi all,

I have a simple question:
In a distributed environment (without SH cluster), what happens when I do a distributed search?

As I understand the SH opens a connection to the search peer(s), send it/them the search bundle, the search peer(s) execute(s) the search, but then what happens?
The search results send back to the SH trough the same connection (what initiate the SH earlier) or the search peer(s) initiate(s) a new connection?

In nutshell my question is:
In a distributed environment during a distributed search from its start to its end, Do exist only SH->search peer communication direction or not?

Thanks in advance!
Tamas

0 Karma
1 Solution

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

tdubicz
Engager

Thank You kindly, sir! 🙂

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...