Deployment Architecture

Why are shared job results not available on other search head cluster members?

dflodstrom
Builder

We have a fully functional Search Head Cluster (6.2.4) behind a load balancer. Users connect to our Search Head Cluster using the load balancer's URL. After running a search, users click the 'Share Job' link and are provided with a URL to share with other Splunk users; the URL contains the hostname of the load balancer. Unless a user, by chance, is directed to the search head where the shared search was originally run, the results are unavailable and the user is taken to the home page.

No artifacts are seen in the dispatch directories on the other member servers for the shared search.

Labels (2)
1 Solution

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

View solution in original post

yoho
Contributor

Hello, same issue here. Is there any update ?

0 Karma

dflodstrom
Builder

I've confirmed with Splunk support that this is normal behavior. We should soon see updated documentation that makes this more clear. I've also generated a feature request to make results from ad-hoc searches replicate across a search head cluster.

Keep an eye out for an updated answer.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.