Splunk Search

How does the splunk search works?

splunker12er
Motivator

When i enter a search query , say (index=* | stats values(source) by host)

How does this fetch the data from the indexer ?

when I have 2 or more indexer , how does the search is splited across the indexers to get the results ?

Is there a flow diagram with process names to get a view ?

Tags (2)
0 Karma

lguinn2
Legend

You could read the book Exploring Splunk, by David Carasso.

There is also an article about Splunk and MapReduce.

But how the search runs across the indexers is managed entirely by Splunk - the user does not do (or even see) anything different, regardless of the number of indexers. The Splunk Admin sets up distributed search, but even that does not specify how individual searches are run - again, that is managed by Splunk.

martin_mueller
SplunkTrust
SplunkTrust

The key for distributing the search over your indexers is the data. If one indexer has twice as much data that matches a search it'll do twice as much work for that particular search.

With your example, each indexer will search all its data on its own and produce a pre-computed stats result (map phase - see the job inspector for the remoteSearch) and the searchhead will produce the overall stats result (reduce phase - see the reportSearch in the job inspector).

Small performance niggle I can't keep to myself:

| tstats values(source) where index=* by host

That will be miles faster 🙂

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...