Splunk Search

How SPL queries work in a distributed environment?

NightShark
Path Finder

Hello Splunkers,

I was wondering if there is a Splunk documentation or an article about how certain search commands behave in a distributed environment.  (i.e. mainly the usage of Join, Stats, Lookup, Sub Searches, Map, Transaction, Tstats etc.)

Descriptions could include about which Splunk node the command first runs, if it goes back and forth between Search Head and Indexer for example or does it only run in one of either. I know how these commands shape and filter certain logs, I just have not fully grasped how Commands are run in the background.

All help and comments are appreciated,

Thanks,

Regards,

0 Karma
1 Solution

NightShark
Path Finder

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @NightShark,

always remember that the only problem on Splunk documentation is that it's usually too much!

Use Google search to find documentation, so you can find many docs, e.g. this https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Whatisdistributedsearch

If instead you want to better know Splunk Commands I hint to use the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial that describes how command works.

In few words:

searches are executed on Search Heads that send requests to Indexers.

Indexers give baks results to SH that take the useful ones (if you have a cluster with replicated data) and display them.

Filters are inserted in the search criteria in SH and applied in IDXs

Ciao.

Giuseppe

0 Karma

NightShark
Path Finder

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @NightShark,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...