Deployment Architecture

should searchhead pooling or mounted knowledge bundles be writing to shared var directory?

tpsplunk
Communicator

I recently enabled searchhead pooling and mounted knowledge bundles using an NFS store mounted to /mnt/shp/ on each of my splunk servers. the {users,apps,system} directories are on /mnt/shp/etc/{users,apps,system}. i've noticed the searchheads have started writing to some "var" directories: /mnt/shp/var/run/splunk/{dispatch,lookup_tmp, rss, scheduler, srtemp}. I don't remember seeing this anywhere in the documentation. is it expected? what is it for? do the search peers (indexers) uses these directories with regards to mounted knowledge bundles?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

the search heads use this to communicate scheduled jobs and job results with each other. the indexers don't care about this information though.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

the search heads use this to communicate scheduled jobs and job results with each other. the indexers don't care about this information though.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...