Deployment Architecture

should searchhead pooling or mounted knowledge bundles be writing to shared var directory?

Communicator

I recently enabled searchhead pooling and mounted knowledge bundles using an NFS store mounted to /mnt/shp/ on each of my splunk servers. the {users,apps,system} directories are on /mnt/shp/etc/{users,apps,system}. i've noticed the searchheads have started writing to some "var" directories: /mnt/shp/var/run/splunk/{dispatch,lookup_tmp, rss, scheduler, srtemp}. I don't remember seeing this anywhere in the documentation. is it expected? what is it for? do the search peers (indexers) uses these directories with regards to mounted knowledge bundles?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

the search heads use this to communicate scheduled jobs and job results with each other. the indexers don't care about this information though.

View solution in original post

Splunk Employee
Splunk Employee

the search heads use this to communicate scheduled jobs and job results with each other. the indexers don't care about this information though.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!