Getting Data In

Where do I point my REST API if I have search head pooling configured?

a212830
Champion

Hi,

If I have Search-Head-Pooling configured, where do I point my REST API? To a physical server? If so, doesn't that defeat the purpose?

1 Solution

Damien_Dallimor
Ultra Champion

Well , you'd likely connect through your load balancer which would route your connection request to 1 of the instances of the Search Head Pool and maintain affinity to that instance for the duration of your REST API session connection.

Or , you could connect to each Search Head instance directly. Really depends on the use case you are trying to satisfy.

View solution in original post

Damien_Dallimor
Ultra Champion

Well , you'd likely connect through your load balancer which would route your connection request to 1 of the instances of the Search Head Pool and maintain affinity to that instance for the duration of your REST API session connection.

Or , you could connect to each Search Head instance directly. Really depends on the use case you are trying to satisfy.

a212830
Champion

Thought so. OK, thanks!

0 Karma

Damien_Dallimor
Ultra Champion

8000 is your Splunk Web port. You'd need a Load Balancing rule for HTTPS protocol on port 8089 (or whatever port you have setup for you management port) and with session affinity/sticky session configured.

a212830
Champion

OK, my load-balancer listen for the management port - it listens on port 8000 - do people setup a separate load-balance for the REST API, or am I missing something?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...