Splunk Search

Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads?

wmyersas
Builder

Like the title says - how are individual searches in a multisearch handled?

Are they distributed across any/all available search slots on any/all available Search Heads? Or do they only run on the Search Head that initiates the search?

Say you have several Search Heads in a Search Head Cluster.

And you have a multisearch like the following:

 

 

 

 

 

 

| multisearch
   [| search index=ndxA sourcetype=srctpA fieldA=* 
   | fields fieldA ]
   [| search index=ndxB sourcetype=srctpB fieldA=* fieldB=* 
   | fields fieldA fieldB ]
   [| search index=ndxC sourcetype=srctpC fieldB=* 
   | fields fieldB ]
   [| inputlookup MyFancyLookup where myLField1=G* 
   | fields myLField1 fieldA fieldB ]
| fillnull value="-" fieldA fieldB myLField1
| stats count by fieldA fieldB myLField1

 

 

 

 

 

 

Will each of the | search or | inputlookup lines run, potentially, on a different Search Head? Or will they all be run from the initiating Search Head?

Labels (1)
0 Karma
1 Solution

wmyersas
Builder

User halr9000 on /r/Splunk cited "Dr Z" (Steve Zhang) as saying these are all run on the initiating Search Head

View solution in original post

0 Karma

wmyersas
Builder

User halr9000 on /r/Splunk cited "Dr Z" (Steve Zhang) as saying these are all run on the initiating Search Head

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...