Splunk Search

Can I have a dedicated search head that only runs scheduled reports?

klim
Path Finder

I have a search head cluster and I will have scheduled reports that send data to a summary index. 

I don't want other users searches to queue or not run this scheduled report. Is it possible to create a dedicated search head to run this scheduled report but the search head cluster still has access to the summary index?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @klim,

yes, as @johnhuang said, it's possible but unless you have so many scheduled searches, in my opinion, it is a waste to use a Search Head just for this purpose.
Also, if this SH stops due to a fail or maintenance, your Scheduled Searchs stop and I don't think it's a useful thing for you.
In my opinion it is preferable to leave the distribution of loads between the SH to the Cluster, and if you have performance problems it is better to add resources to the SHs or a new Search Head, rather than dedicating one to run the Scheduled Searches.

Ciao.

Giuseppe

0 Karma

johnhuang
Motivator

Yes you could do that.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...