Deployment Architecture

Why are shared job results not available on other search head cluster members?

dflodstrom
Builder

We have a fully functional Search Head Cluster (6.2.4) behind a load balancer. Users connect to our Search Head Cluster using the load balancer's URL. After running a search, users click the 'Share Job' link and are provided with a URL to share with other Splunk users; the URL contains the hostname of the load balancer. Unless a user, by chance, is directed to the search head where the shared search was originally run, the results are unavailable and the user is taken to the home page.

No artifacts are seen in the dispatch directories on the other member servers for the shared search.

Labels (2)
1 Solution

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

View solution in original post

yoho
Contributor

Hello, same issue here. Is there any update ?

0 Karma

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...