Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Deployment Architecture
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Search job execution in search head cluster enviro...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yutaka1005
Builder
11-08-2017
07:39 PM
I have two questions about search job execution when search head cluster is used.
In a search head cluster, when I access a specific search head from a browser and search there, is the job execute with the search head that I access?
Or, if there are members that have fewer load, will the member responsible for processing?Is there a way to check which members performed the schedule search?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
skalliger
Motivator
11-09-2017
03:07 AM
Hi,
- Yes, the searches you are doing in realtime are being ran on the server you are logged on to.
- Yes, if you're using the Monitoring Console (former DMC) it's quite easy. You can simply access a) the "Scheduler Activity" in the "Search" menu or b) the "Scheduler Delegation" in the "Search" > "Search Head Clustering" menu.
Skalli
edit: typo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
skalliger
Motivator
11-09-2017
03:07 AM
Hi,
- Yes, the searches you are doing in realtime are being ran on the server you are logged on to.
- Yes, if you're using the Monitoring Console (former DMC) it's quite easy. You can simply access a) the "Scheduler Activity" in the "Search" menu or b) the "Scheduler Delegation" in the "Search" > "Search Head Clustering" menu.
Skalli
edit: typo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yutaka1005
Builder
11-09-2017
09:43 PM
Hi skalliger,
I'm sorry I have asked you many times.
Yes, the searches you are doing in realtime are being ran on the server you are logged on to.
→ Is this "realtime" means not "real-time searches" but "all searches" that I log in and execute from the GUI search screen?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
skalliger
Motivator
11-09-2017
11:22 PM
Yep, that's correct.
I referred to it as "realtime" because I simply distinguish "realtime" from "scheduled".
Any other questions? 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yutaka1005
Builder
11-13-2017
05:10 PM
Thank you for comment.
I understood it.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!
Tech Talk Recap | Mastering Threat Hunting
Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...
Observability for AI Applications: Troubleshooting Latency
If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...
