Splunk Enterprise

Allocate a scheduled search to all searcheads in a searchead cluster

sebastian_m
Engager

Hello there,

we use an alert action that has a lot of technical dependencies. In order to make sure that all searchheads are able to perform this alert action we would like to make a regular check of all of them. Our idea was to use a simple scheduled search that triggers the alert action on a regular basis as a test, to see if everything is fine.

The problem is, that we don't know if it is possible to force the searchhead captain to allocate this specific search to all members of its cluster. Otherwise we would only see if the member that coincidentally got the search functions properly.

Do you know of any way to achieve, that all members of a searchead cluster run a specific search?

Thanks in advance for the help.

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

In normal situation captain sends search to one of members to run. You cannot specify in which node it runs or specify that it run every one.

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

In normal situation captain sends search to one of members to run. You cannot specify in which node it runs or specify that it run every one.

0 Karma

sebastian_m
Engager

That is unfortunate. But thanks for your reply.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...