Deployment Architecture

Search head - Search peer communication direction in distributed enviroment

tdubicz
Engager

Hi all,

I have a simple question:
In a distributed environment (without SH cluster), what happens when I do a distributed search?

As I understand the SH opens a connection to the search peer(s), send it/them the search bundle, the search peer(s) execute(s) the search, but then what happens?
The search results send back to the SH trough the same connection (what initiate the SH earlier) or the search peer(s) initiate(s) a new connection?

In nutshell my question is:
In a distributed environment during a distributed search from its start to its end, Do exist only SH->search peer communication direction or not?

Thanks in advance!
Tamas

0 Karma
1 Solution

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Yes. All traffic between SH and Peers is over the rest api.

This means SH communicates with the Peer on tcp:8089.
The peer will send search result data to the SH as the response to the web services request.

It’s TCP so it’s bi-directional, but the peer will never initiate a socket to the SH.
(Unless the SH is also a DS or Lic Master)

If my comment helps, please give it a thumbs up!

tdubicz
Engager

Thank You kindly, sir! 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...