Splunk Search

Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads?

wmyersas
Builder

Like the title says - how are individual searches in a multisearch handled?

Are they distributed across any/all available search slots on any/all available Search Heads? Or do they only run on the Search Head that initiates the search?

Say you have several Search Heads in a Search Head Cluster.

And you have a multisearch like the following:

 

 

 

 

 

 

| multisearch
   [| search index=ndxA sourcetype=srctpA fieldA=* 
   | fields fieldA ]
   [| search index=ndxB sourcetype=srctpB fieldA=* fieldB=* 
   | fields fieldA fieldB ]
   [| search index=ndxC sourcetype=srctpC fieldB=* 
   | fields fieldB ]
   [| inputlookup MyFancyLookup where myLField1=G* 
   | fields myLField1 fieldA fieldB ]
| fillnull value="-" fieldA fieldB myLField1
| stats count by fieldA fieldB myLField1

 

 

 

 

 

 

Will each of the | search or | inputlookup lines run, potentially, on a different Search Head? Or will they all be run from the initiating Search Head?

Labels (1)
0 Karma
1 Solution

wmyersas
Builder

User halr9000 on /r/Splunk cited "Dr Z" (Steve Zhang) as saying these are all run on the initiating Search Head

View solution in original post

0 Karma

wmyersas
Builder

User halr9000 on /r/Splunk cited "Dr Z" (Steve Zhang) as saying these are all run on the initiating Search Head

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...