Splunk Search

Export scheduled saved search processing to another server

rbw78
Communicator

Hello,

Currently we're processing about 30 scheduled saved search in our splunk server.
The processing of these searches are taking a lot of ressources in CPU and memory.

So i was wondering if there's a way to export the processing functions to another server making our splunk server less overloaded ?
The goal would be to use the splunk server to just ensure the display of the searches on the dashboards.

Thanks

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

it'a called a dedicated search-head, and you can setup your scheduled searches on it.
The difficulty is to separate them properly and avoid to have them run twice.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Installadedicatedsearchhead

If you want to see the results on your other search-head, you can save the results in a summary index (and forward it to the indexers). That way your dashboards will show preprocessed results (much faster).

Have you tried splunk 5.0, it has search improvement for statistical results.

Keep in mind that ultimately the searches will run on the indexers too.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

it'a called a dedicated search-head, and you can setup your scheduled searches on it.
The difficulty is to separate them properly and avoid to have them run twice.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Installadedicatedsearchhead

If you want to see the results on your other search-head, you can save the results in a summary index (and forward it to the indexers). That way your dashboards will show preprocessed results (much faster).

Have you tried splunk 5.0, it has search improvement for statistical results.

Keep in mind that ultimately the searches will run on the indexers too.

0 Karma

rbw78
Communicator

Great, thanks for the answer I hadn't seen this feature in the documentation that exactly what i was looking for.

0 Karma

yannK
Splunk Employee
Splunk Employee

I forgot to mention the search-head pooling (using a shared folder between the search-heads). Any available search-head will run the search, and the results will be available from both in the shared dispatch folders.

It has some high requirements to run properly, so test well before.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configuresearchheadpooling

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...