Getting Data In

What are the options for synchronizing namespace tsidx files in a search head cluster?

responsys_cm
Builder

One option is obviously to use shared storage. That's a least desirable option.

If I schedule the search to run tscollect, it will be run on a random search head in the cluster, right?

So another option would be to save the search to all cluster members and then use a cron job on each one to run the search and generate the namespace's tsidx files...?

Is there any other cleaner way to do this?

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @responsys_cm !

Sorry you haven't received any answers to your question. I'm sure help is on the way!

But, in the mean time, If you want to try to get some immediate help for your question, you should join the 5000+ Splunk users in our public Slack Community chat. People ask each other for immediate help on there daily. You can share your question/link to your post there to see if anyone can take a stab at it.

You first have to request access through https://splk.it/slack. Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process may take a couple days), you can access Slack.com and ask for help in the #general channel.

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...