Export scheduled saved search processing to another server

[rbw78]

Hello,

Currently we're processing about 30 scheduled saved search in our splunk server.
The processing of these searches are taking a lot of ressources in CPU and memory.

So i was wondering if there's a way to export the processing functions to another server making our splunk server less overloaded ?
The goal would be to use the splunk server to just ensure the display of the searches on the dashboards.

Thanks

[yannK · Accepted solution]

it'a called a dedicated search-head, and you can setup your scheduled searches on it.
The difficulty is to separate them properly and avoid to have them run twice.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Installadedicatedsearchhead

If you want to see the results on your other search-head, you can save the results in a summary index (and forward it to the indexers). That way your dashboards will show preprocessed results (much faster).

Have you tried splunk 5.0, it has search improvement for statistical results.

Keep in mind that ultimately the searches will run on the indexers too.

[rbw78]

Great, thanks for the answer I hadn't seen this feature in the documentation that exactly what i was looking for.

[yannK]

I forgot to mention the search-head pooling (using a shared folder between the search-heads). Any available search-head will run the search, and the results will be available from both in the shared dispatch folders.

It has some high requirements to run properly, so test well before.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configuresearchheadpooling