Splunk Search

How SPL queries work in a distributed environment?

NightShark
Path Finder

Hello Splunkers,

I was wondering if there is a Splunk documentation or an article about how certain search commands behave in a distributed environment.  (i.e. mainly the usage of Join, Stats, Lookup, Sub Searches, Map, Transaction, Tstats etc.)

Descriptions could include about which Splunk node the command first runs, if it goes back and forth between Search Head and Indexer for example or does it only run in one of either. I know how these commands shape and filter certain logs, I just have not fully grasped how Commands are run in the background.

All help and comments are appreciated,

Thanks,

Regards,

0 Karma
1 Solution

NightShark
Path Finder

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @NightShark,

always remember that the only problem on Splunk documentation is that it's usually too much!

Use Google search to find documentation, so you can find many docs, e.g. this https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Whatisdistributedsearch

If instead you want to better know Splunk Commands I hint to use the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial that describes how command works.

In few words:

searches are executed on Search Heads that send requests to Indexers.

Indexers give baks results to SH that take the useful ones (if you have a cluster with replicated data) and display them.

Filters are inserted in the search criteria in SH and applied in IDXs

Ciao.

Giuseppe

0 Karma

NightShark
Path Finder

Hello Giuseppe,

Thank you for the valuable information, however I was actually looking more towards the following article which I have finally found, than an overview on how search queries were actually run in a distributed enviroment:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Search/Typesofcommands

Apologies for the misunderstanding,

Regards,

0 Karma

gcusello
Esteemed Legend

Hi @NightShark,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...