Is there any ways to limit network traffic between Search Head and Peers ?

[sunrise]

Hi Splunkers,

I know about we are able to limit network traffic
between Peer （a.k.a. Indexer ）and Universal Forwarder.
How about the network traffic between Search Head and Peers ?
Is there any settings to get limitations of that traffic ?

Thank you for your help.

[lmyrefelt · Accepted solution]

You can play around with settings inside of distsearch.conf

like ...

[replicationSettings]
replicationThreads
maxMemoryBundleSize
sanitizeMetaFiles
allowDeltaUpload
allowStreamUpload

But more intressting could be

[replicationBlacklist]

And

[replicationWhitelist]

I also belive there is a time-setting you can configure for how often it will try to poll/push /check for changes to the "bundle" .. can remember were...

Hope this helps!

[lmyrefelt]

I guess the rest of the traffic depends on the searches, its results , number of users and number of searches ...

reduce users and reduces searches and you reduces the network traffik between the nodes ...

There might be some setting around using / not using ssl / maybe some compression to set in server.conf or web.conf to controll the transport (protokol/mechanism) between sh and indexer

[gfuente]

Hello

You could reduce some bandwith usage by using a mounted bundle, so the SH doesn´t have to replicate the bundle to the peers.

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Mounttheknowledgebundle

Aside from that, the search peers have to stream the results to the SH, so probably if you do the searches triying to maximize the reduce part (what happens in the indexers) then, the reduced result set streamed to the SH will be smaller therefore saving some bandwith too. So try to use as many streaming commands, before running non streaming commands

Take a look at:

http://docs.splunk.com/Splexicon:Streamingcommand

I only could think of this couple of things to reduce the bandwith usage between SH and SPs

Hope it helps

Regards

[acharlieh]

Offhand, I believe the search head only needs to invoke the Splunk API port of the search peers (and cluster master), but I'm trying to find docs before making an answer.

[MuS]

@acharlieh, I think @sunrise wants to limit the network bandwidth usage between SH and SP.....