Deployment Architecture

Why are shared job results not available on other search head cluster members?

dflodstrom
Builder

We have a fully functional Search Head Cluster (6.2.4) behind a load balancer. Users connect to our Search Head Cluster using the load balancer's URL. After running a search, users click the 'Share Job' link and are provided with a URL to share with other Splunk users; the URL contains the hostname of the load balancer. Unless a user, by chance, is directed to the search head where the shared search was originally run, the results are unavailable and the user is taken to the home page.

No artifacts are seen in the dispatch directories on the other member servers for the shared search.

Labels (2)
1 Solution

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

View solution in original post

yoho
Contributor

Hello, same issue here. Is there any update ?

0 Karma

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...