Deployment Architecture

should searchhead pooling or mounted knowledge bundles be writing to shared var directory?

tpsplunk
Communicator

I recently enabled searchhead pooling and mounted knowledge bundles using an NFS store mounted to /mnt/shp/ on each of my splunk servers. the {users,apps,system} directories are on /mnt/shp/etc/{users,apps,system}. i've noticed the searchheads have started writing to some "var" directories: /mnt/shp/var/run/splunk/{dispatch,lookup_tmp, rss, scheduler, srtemp}. I don't remember seeing this anywhere in the documentation. is it expected? what is it for? do the search peers (indexers) uses these directories with regards to mounted knowledge bundles?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

the search heads use this to communicate scheduled jobs and job results with each other. the indexers don't care about this information though.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

the search heads use this to communicate scheduled jobs and job results with each other. the indexers don't care about this information though.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...