Monitoring Splunk

How to run a script only on one search head in a SH cluster, preferably the captain?

RDumbeck
Explorer

i have a script that is currently executing on all search heads.  Is there a way to execute on only the current captain?

I need only one of my search heads to return results. 

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Depends on what you mean "run a script". If you want to use OS-level CLI to chose just one node to run the script on, just do "splunk show shcluster-status" and check which node is the captain. Then run only on that node. If you want to run it directly from Splunk's search window by means of | script command, it will only be run on one node (the one you're connected to in case of interactive search or any node it will get scheduled to by scheduler in case of scheduled searches).

So what's the use case?

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Depends on what you mean "run a script". If you want to use OS-level CLI to chose just one node to run the script on, just do "splunk show shcluster-status" and check which node is the captain. Then run only on that node. If you want to run it directly from Splunk's search window by means of | script command, it will only be run on one node (the one you're connected to in case of interactive search or any node it will get scheduled to by scheduler in case of scheduled searches).

So what's the use case?

0 Karma

RDumbeck
Explorer

This is a scripted input that is set to run every minute.   I was hoping there was a setting for the input in inputs.conf that would cause this behavior, but this will work.  Thanks for the info. 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well... there is another thing to consider with inputs - why would you want to run your inputs on the search-head? You typically set up a HF for this (for scripted input even a UF should do). And why, oh why, would you distribute such input to all SHC members??? That's counterintuitive - first you want to create several separate instances of your input, then you want to disable almost all of them. Seems pointless.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @RDumbeck ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @RDumbeck,

if you associate the script execution to an Alert, managed by the Search Head Cluster, your script will be executed only one time.

I used this solution to send SNMP traps to an external system.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...