Deployment Architecture

Will old jobs from search head pooling be usable after upgrading to search head clustering?

ben_leung
Builder

Upgrading from search head pooling to search head clustering, the jobs in dispatch have a slight change in naming convention due to the replication of artifacts within search head clustering.

When upgrading to search head clustering, will we be able to copy paste the existing jobs from the pool into each individual search head so that the artifacts are retained/usable post upgrade?

0 Karma

RicoSuave
Builder

No, they will not. There is no way to inform the Search Head Cluster about these dispatch directories so the search heads will not be aware of them if you copy them in.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...