Splunk Search

[SHC]Clarification on scheduler_load_based?

rbal_splunk
Splunk Employee
Splunk Employee

How does captain scheduler_load_based calculation on its members to distribute scheduled saved searches ? Is it based on number of searches currently running or available cores or memory etc

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Each members send the number of searches they are running for the past 1m, 5m, 15m to the captain. It does a heuristics on that

Captain selects a peer by two approach

load based :
Each member sends its load over its heartbeat to captain (1m, 5m, 15m) just the searches it have seen during this period. Captain picks one with a simple heuristics.

Round robin:
Just pick next in a circular loop on the UP peers.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...