Deployment Architecture

Why are shared job results not available on other search head cluster members?

dflodstrom
Builder

We have a fully functional Search Head Cluster (6.2.4) behind a load balancer. Users connect to our Search Head Cluster using the load balancer's URL. After running a search, users click the 'Share Job' link and are provided with a URL to share with other Splunk users; the URL contains the hostname of the load balancer. Unless a user, by chance, is directed to the search head where the shared search was originally run, the results are unavailable and the user is taken to the home page.

No artifacts are seen in the dispatch directories on the other member servers for the shared search.

Labels (2)
1 Solution

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

View solution in original post

yoho
Contributor

Hello, same issue here. Is there any update ?

0 Karma

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...