Splunk Search

Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads?

wmyersas
Builder

Like the title says - how are individual searches in a multisearch handled?

Are they distributed across any/all available search slots on any/all available Search Heads? Or do they only run on the Search Head that initiates the search?

Say you have several Search Heads in a Search Head Cluster.

And you have a multisearch like the following:

 

 

 

 

 

 

| multisearch
   [| search index=ndxA sourcetype=srctpA fieldA=* 
   | fields fieldA ]
   [| search index=ndxB sourcetype=srctpB fieldA=* fieldB=* 
   | fields fieldA fieldB ]
   [| search index=ndxC sourcetype=srctpC fieldB=* 
   | fields fieldB ]
   [| inputlookup MyFancyLookup where myLField1=G* 
   | fields myLField1 fieldA fieldB ]
| fillnull value="-" fieldA fieldB myLField1
| stats count by fieldA fieldB myLField1

 

 

 

 

 

 

Will each of the | search or | inputlookup lines run, potentially, on a different Search Head? Or will they all be run from the initiating Search Head?

Labels (1)
0 Karma
1 Solution

wmyersas
Builder

User halr9000 on /r/Splunk cited "Dr Z" (Steve Zhang) as saying these are all run on the initiating Search Head

View solution in original post

0 Karma

wmyersas
Builder

User halr9000 on /r/Splunk cited "Dr Z" (Steve Zhang) as saying these are all run on the initiating Search Head

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!