Reporting

report acceleration besides existing job server

Starlette
Contributor

hi there

Should accelerated reports configed with sh1 be visible and picked up with sh2?
Thats the basic question, the idea behind this is that i configed the searches from a jobserver but the main indexer isnt use them.
So this is not a set for sh pooling. Iam also curious whats best pratice if I using report accelation against si cube indexes. any tips for this as well?

chrz

hexx
Splunk Employee
Splunk Employee

Currently, if one defines report accelerations on a 'job server' isolated search-head, other search-heads will not be aware of the summaries created on the indexers. These summaries are scoped to the search-head or search-head pool where the report acceleration was defined, so unless they are part of the same search-head pool, the other search-heads will not be aware of their presence, nor is there are why to make them manually aware.

Note that segregating the scheduling of report acceleration on a job server would yield almost no benefit, as report acceleration activity happens only on the indexers and the search-head does almost no work other than record-keeping.

That being said, if you feel strongly that this functionality should be provided (for the purpose of type-based search activity segregation, for example), by all means please file an enhancement request for it.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...