Help with Interview prep

[alexlexxy]

Describe what happens when an adhoc search is issued on a search head in a distributed environment?

Does the search head communicate with the cluster master or directly with the indexers? Im looking for clarifications. 

[alexlexxy]

@venkatasri  thank you for the response, however,  I was just wondering what will happen if the cluster master goes down, will the SH be able to return results of an adhoc search?

[venkatasri · Accepted solution]

@alexlexxy 

explained here don't want to re-write. 🙂

https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Whathappenswhenamanagernodegoesdown#When_...

[alexlexxy]

Totally! thank you.

[venkatasri]

@alexlexxy  SH does communicate with cluster master before finding out which peers to fetch results.

more detailed notes here,

https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Howclusteredsearchworks#Search_across_a_s...