Splunk Search

Distributed search groups not actually filtering searches

Lucas_K
Motivator

We are using distributed search groups ( http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Distributedsearchgroups ).

We have 2 sets of indexers: index group A and index group b.

We have a config similar to the following.

distsearch.conf
[distributedSearch]
servers = indexa_1:8089,indexa_2:8089,indexb_1:8089,indexb_2:8089

[distributedSearch:groupa]
default = true
servers = indexa_1:8089,indexa_2:8089

[distributedSearch:groupb]
servers = indexb_1:8089,indexb_2:8089

[distributedSearch:all]
servers = indexa_1:8089,indexa_2:8089,indexb_1:8089,indexb_2:8089

I am finding that if I check /opt/splunk/var/log/splunk/remote_searches.log on indexb_1 or indexb_2 I can see certain searches from this search head hitting them when they shouldn't.

These particular searches do not have splunk_server_group=groupb or splunk_server_group=all in the query.
They do all seem to have "presummarize" or "scheduler" in their search. I'm not seeing interactive search sessions though.

Do distributed search groups only stop searches from interactive searches?

This seems like a hole/bug.

0 Karma

peterchenadded
Path Finder

We are seeing this issue for accelerated datamodels.

For other types of searches we were able to get around them by quarantining servers.

For accelerated datamodels it seems to be ignoring all the rules as shown below:

04-05-2018 21:32:33.384 INFO SearchProcessor - Search targeting info not set on processor presummarize. Will contact all peers by default
04-05-2018 21:32:33.384 INFO DistributedSearchResultCollectionManager - Connecting to peer HOST1 connectAll 0 connectToSpecificPeer 1

Anyone else have any luck with this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...