Reporting
Highlighted

Scheduled searches with a jobs server and pooling

Splunk Employee
Splunk Employee

We are running pooling. We have a separate jobs server that is only running scheduled searches. This jobs server is NOT pooled because of the load it puts on the pooling environment.

We have dashboards that pull up the cached results of a scheduled search because the search takes too long to run. The problem we are seeing is that since the jobs server is not pooled apparently those results are not accessible by the dashboard.

In what directory are the cached results stored so that we can do a rsync of that information? Is there a better way of doing this?

0 Karma
Highlighted

Re: Scheduled searches with a jobs server and pooling

Motivator

searches jobs results should be in splunk/var/run/splunk/dispatch

0 Karma
Highlighted

Re: Scheduled searches with a jobs server and pooling

Splunk Employee
Splunk Employee

you would need to sync them to the pooled dispatch directory though. I don't remember the exact path, but there will be a dispatch directory under there as well.

0 Karma
Highlighted

Re: Scheduled searches with a jobs server and pooling

Splunk Employee
Splunk Employee

Thanks. I will give it a try.

0 Karma