Splunk Search

Export scheduled saved search processing to another server

rbw78
Communicator

Hello,

Currently we're processing about 30 scheduled saved search in our splunk server.
The processing of these searches are taking a lot of ressources in CPU and memory.

So i was wondering if there's a way to export the processing functions to another server making our splunk server less overloaded ?
The goal would be to use the splunk server to just ensure the display of the searches on the dashboards.

Thanks

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

it'a called a dedicated search-head, and you can setup your scheduled searches on it.
The difficulty is to separate them properly and avoid to have them run twice.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Installadedicatedsearchhead

If you want to see the results on your other search-head, you can save the results in a summary index (and forward it to the indexers). That way your dashboards will show preprocessed results (much faster).

Have you tried splunk 5.0, it has search improvement for statistical results.

Keep in mind that ultimately the searches will run on the indexers too.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

it'a called a dedicated search-head, and you can setup your scheduled searches on it.
The difficulty is to separate them properly and avoid to have them run twice.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Installadedicatedsearchhead

If you want to see the results on your other search-head, you can save the results in a summary index (and forward it to the indexers). That way your dashboards will show preprocessed results (much faster).

Have you tried splunk 5.0, it has search improvement for statistical results.

Keep in mind that ultimately the searches will run on the indexers too.

0 Karma

rbw78
Communicator

Great, thanks for the answer I hadn't seen this feature in the documentation that exactly what i was looking for.

0 Karma

yannK
Splunk Employee
Splunk Employee

I forgot to mention the search-head pooling (using a shared folder between the search-heads). Any available search-head will run the search, and the results will be available from both in the shared dispatch folders.

It has some high requirements to run properly, so test well before.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configuresearchheadpooling

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...