How does the splunk search works?

[splunker12er]

When i enter a search query , say (index=* | stats values(source) by host)

How does this fetch the data from the indexer ?

when I have 2 or more indexer , how does the search is splited across the indexers to get the results ?

Is there a flow diagram with process names to get a view ?

[lguinn2]

You could read the book Exploring Splunk, by David Carasso.

There is also an article about Splunk and MapReduce.

But how the search runs across the indexers is managed entirely by Splunk - the user does not do (or even see) anything different, regardless of the number of indexers. The Splunk Admin sets up distributed search, but even that does not specify how individual searches are run - again, that is managed by Splunk.

[martin_mueller]

The key for distributing the search over your indexers is the data. If one indexer has twice as much data that matches a search it'll do twice as much work for that particular search.

With your example, each indexer will search all its data on its own and produce a pre-computed stats result (map phase - see the job inspector for the remoteSearch) and the searchhead will produce the overall stats result (reduce phase - see the reportSearch in the job inspector).

Small performance niggle I can't keep to myself:

| tstats values(source) where index=* by host

That will be miles faster 🙂