Scheduled searches with a jobs server and pooling

[rmorlen]

We are running pooling. We have a separate jobs server that is only running scheduled searches. This jobs server is NOT pooled because of the load it puts on the pooling environment.

We have dashboards that pull up the cached results of a scheduled search because the search takes too long to run. The problem we are seeing is that since the jobs server is not pooled apparently those results are not accessible by the dashboard.

In what directory are the cached results stored so that we can do a rsync of that information? Is there a better way of doing this?

[MarioM]

searches jobs results should be in splunk/var/run/splunk/dispatch

[rmorlen]

Thanks. I will give it a try.

[gkanapathy]

you would need to sync them to the pooled dispatch directory though. I don't remember the exact path, but there will be a dispatch directory under there as well.