How distributed search works
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
How distributed search works
Distributed search is a peer-to-peer configuration that enables one Splunk server to send searches across many other Splunk instances. Upon login, authentication attempts are federated across all other included servers. Users can only search those Splunk servers where their credentials are accepted. Users can restrict any search to explicitly search only a subset of the servers.
Each Splunk server in a distributed search configuration must have an Enterprise license.
Distributed search is typically used to:
- enable correlation among multiple silos of data for a subset of users.
- provide a single view of data across multiple indexing servers.
- provide a single view across Splunk servers that are indexing data locally on production hosts, where network bandwidth favors centralizing data at search time rather than index time.
Note: Distributed search uses the management port (default 8089), so SSL must be either off or on for all servers. By default, SSL is turned on for the management port. If you turn it off for one server, you must turn it off for all servers.
Known issues with distributed search
- You cannot use distributed search across 3.1.x and 3.2 Splunk servers; you must upgrade all your Splunk servers to 3.2 in order to use distributed search.
- Network speed affects distributed search speed. If you're searching over a VPN, you may notice distributed search taking longer, depending on your connection speed.
- Search time field extraction configuration must be configured on each of the servers providing the distributed search results.
- Distributed search requires the allow_livetail capability. By default, Admin and Power Roles have this capability. You will need to grant the User role this capability if you want them to be able to use distributed search.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 View the Article History for its revisions.