Deployment Architecture
Highlighted

What does status=delegated_remote OR status=delegated_remote_completion mean in the scheduler log?

Builder

If looking at scheduler log from a single search head in the search head cluster, what does status=delegatedremote OR status=delegatedremote_completion mean? Does it mean that the search that was running to the current search head move to another search peer to run and complete?

Highlighted

Re: What does status=delegated_remote OR status=delegated_remote_completion mean in the scheduler log?

Builder

I have not yet seen the scheduler skip a search yet... Wondering how the log looks like when it does skip... Anyone experience this in SHC yet?

0 Karma
Highlighted

Re: What does status=delegated_remote OR status=delegated_remote_completion mean in the scheduler log?

Splunk Employee
Splunk Employee

This is logged on the captain in scheduler.log when a remote job is delegated to a member and when a remote delegated job is completed on a member.

Jacob
Sr. Technical Support Engineer
Highlighted

Re: What does status=delegated_remote OR status=delegated_remote_completion mean in the scheduler log?

Builder

How do you determine the peer the search was sent to?
I have a 2 peer SH cluster and the captain says status=delegated_remote and we received no alert. Not to mention that the other peer (not captain) is configured to be adhoc searching only. So why did the captain delegate it?

0 Karma
Highlighted

Re: What does status=delegated_remote OR status=delegated_remote_completion mean in the scheduler log?

Splunk Employee
Splunk Employee

How do you have a two peer SHC? At least 3 Search heads are required.

0 Karma
Highlighted

Re: What does status=delegated_remote OR status=delegated_remote_completion mean in the scheduler log?

Splunk Employee
Splunk Employee

memberlabel / memberguid / member_uri from the same message. I've seen the captain report that it delegated a search to itself.

0 Karma