Deployment Architecture

Search head - Search peer communication direction in distributed enviroment

tdubicz
Engager

Hi all,

I have a simple question:
In a distributed environment (without SH cluster), what happens when I do a distributed search?

As I understand the SH opens a connection to the search peer(s), send it/them the search bundle, the search peer(s) execute(s) the search, but then what happens?
The search results send back to the SH trough the same connection (what initiate the SH earlier) or the search peer(s) initiate(s) a new connection?

In nutshell my question is:
In a distributed environment during a distributed search from its start to its end, Do exist only SH->search peer communication direction or not?

Thanks in advance!
Tamas

0 Karma
1 Solution

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

tdubicz
Engager

Thank You kindly, sir! 🙂

0 Karma
Get Updates on the Splunk Community!

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...