How SPL queries work in a distributed environment?

[NightShark]

Hello Splunkers,

I was wondering if there is a Splunk documentation or an article about how certain search commands behave in a distributed environment.  (i.e. mainly the usage of Join, Stats, Lookup, Sub Searches, Map, Transaction, Tstats etc.)

Descriptions could include about which Splunk node the command first runs, if it goes back and forth between Search Head and Indexer for example or does it only run in one of either. I know how these commands shape and filter certain logs, I just have not fully grasped how Commands are run in the background.

All help and comments are appreciated,

Thanks,

Regards,

[gcusello]

Hi @NightShark,

always remember that the only problem on Splunk documentation is that it's usually too much!

Use Google search to find documentation, so you can find many docs, e.g. this https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Whatisdistributedsearch

If instead you want to better know Splunk Commands I hint to use the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial that describes how command works.

In few words:

searches are executed on Search Heads that send requests to Indexers.

Indexers give baks results to SH that take the useful ones (if you have a cluster with replicated data) and display them.

Filters are inserted in the search criteria in SH and applied in IDXs

Ciao.

Giuseppe

[NightShark · Accepted solution]

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

[gcusello]

Hi @NightShark,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉