Reporting

report acceleration besides existing job server

Starlette
Contributor

hi there

Should accelerated reports configed with sh1 be visible and picked up with sh2?
Thats the basic question, the idea behind this is that i configed the searches from a jobserver but the main indexer isnt use them.
So this is not a set for sh pooling. Iam also curious whats best pratice if I using report accelation against si cube indexes. any tips for this as well?

chrz

hexx
Splunk Employee
Splunk Employee

Currently, if one defines report accelerations on a 'job server' isolated search-head, other search-heads will not be aware of the summaries created on the indexers. These summaries are scoped to the search-head or search-head pool where the report acceleration was defined, so unless they are part of the same search-head pool, the other search-heads will not be aware of their presence, nor is there are why to make them manually aware.

Note that segregating the scheduling of report acceleration on a job server would yield almost no benefit, as report acceleration activity happens only on the indexers and the search-head does almost no work other than record-keeping.

That being said, if you feel strongly that this functionality should be provided (for the purpose of type-based search activity segregation, for example), by all means please file an enhancement request for it.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...