Reporting

Scheduled searches with a jobs server and pooling

rmorlen
Splunk Employee
Splunk Employee

We are running pooling. We have a separate jobs server that is only running scheduled searches. This jobs server is NOT pooled because of the load it puts on the pooling environment.

We have dashboards that pull up the cached results of a scheduled search because the search takes too long to run. The problem we are seeing is that since the jobs server is not pooled apparently those results are not accessible by the dashboard.

In what directory are the cached results stored so that we can do a rsync of that information? Is there a better way of doing this?

0 Karma

MarioM
Motivator

searches jobs results should be in splunk/var/run/splunk/dispatch

0 Karma

rmorlen
Splunk Employee
Splunk Employee

Thanks. I will give it a try.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

you would need to sync them to the pooled dispatch directory though. I don't remember the exact path, but there will be a dispatch directory under there as well.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...