Splunk Search

How SPL queries work in a distributed environment?

NightShark
Path Finder

Hello Splunkers,

I was wondering if there is a Splunk documentation or an article about how certain search commands behave in a distributed environment.  (i.e. mainly the usage of Join, Stats, Lookup, Sub Searches, Map, Transaction, Tstats etc.)

Descriptions could include about which Splunk node the command first runs, if it goes back and forth between Search Head and Indexer for example or does it only run in one of either. I know how these commands shape and filter certain logs, I just have not fully grasped how Commands are run in the background.

All help and comments are appreciated,

Thanks,

Regards,

0 Karma
1 Solution

NightShark
Path Finder

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

View solution in original post

0 Karma

gcusello
Legend

Hi @NightShark,

always remember that the only problem on Splunk documentation is that it's usually too much!

Use Google search to find documentation, so you can find many docs, e.g. this https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Whatisdistributedsearch

If instead you want to better know Splunk Commands I hint to use the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial that describes how command works.

In few words:

searches are executed on Search Heads that send requests to Indexers.

Indexers give baks results to SH that take the useful ones (if you have a cluster with replicated data) and display them.

Filters are inserted in the search criteria in SH and applied in IDXs

Ciao.

Giuseppe

0 Karma

NightShark
Path Finder

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

0 Karma

gcusello
Legend

Hi @NightShark,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...