How to run a script only on one search head in a SH cluster, preferably the captain?

[RDumbeck]

i have a script that is currently executing on all search heads.  Is there a way to execute on only the current captain?

I need only one of my search heads to return results. 

[hrawat]

Did you tied( if it's one of the input types mentioned) ?

run_only_one= <boolean>
* Determines if a scripted or modular inputs runs on one search head
  in SHC.

[PickleRick · Accepted solution]

Depends on what you mean "run a script". If you want to use OS-level CLI to chose just one node to run the script on, just do "splunk show shcluster-status" and check which node is the captain. Then run only on that node. If you want to run it directly from Splunk's search window by means of | script command, it will only be run on one node (the one you're connected to in case of interactive search or any node it will get scheduled to by scheduler in case of scheduled searches).

So what's the use case?

[RDumbeck]

This is a scripted input that is set to run every minute.   I was hoping there was a setting for the input in inputs.conf that would cause this behavior, but this will work.  Thanks for the info. 

[PickleRick]

Well... there is another thing to consider with inputs - why would you want to run your inputs on the search-head? You typically set up a HF for this (for scripted input even a UF should do). And why, oh why, would you distribute such input to all SHC members??? That's counterintuitive - first you want to create several separate instances of your input, then you want to disable almost all of them. Seems pointless.

[gcusello]

Hi @RDumbeck ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @RDumbeck,

if you associate the script execution to an Alert, managed by the Search Head Cluster, your script will be executed only one time.

I used this solution to send SNMP traps to an external system.

Ciao.

Giuseppe