Splunk Dev

Can I load balancing REST API searches to a search head cluster?

mdwecht
Path Finder

Splunkers,

I have an external analytic engine that is currently making Splunk REST API calls to a specific search head in a search head cluster to pull data sets for analysis. It works great but I want to be able to load balance these REST calls across the search head cluster and each search requires a minimum of three REST calls to start the search, check the search status, and retrieve any available search results. I am sure I am not the first individual to require this functionality. Is this functionality already available in Splunk? Has anyone seen an open source implementation? Does a Phantom instance connect to a single Splunk search head? I don't want to degrade the user experience on a search head by having it dedicated to serving up data sets. Please advise...

Thanks,

Mark

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

As per Splunk docs, for search-head cluster you should use a load-balancer that can keep a sticky session.

So if you intiate a first connection with no additional cookies added to it, you should get a session, or a server cookie (depending on how your LB is configured) and you should send this cookie with subsequent requests in order to get to the same backend (search-head).

Then for next search you again send initial request without the cookie, get cookie in response and sent it with additional REST calls.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As per Splunk docs, for search-head cluster you should use a load-balancer that can keep a sticky session.

So if you intiate a first connection with no additional cookies added to it, you should get a session, or a server cookie (depending on how your LB is configured) and you should send this cookie with subsequent requests in order to get to the same backend (search-head).

Then for next search you again send initial request without the cookie, get cookie in response and sent it with additional REST calls.

0 Karma

Akeydel
Explorer

Do you have a link to those Splunk docs?

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...