Splunk Inc.
Configuration file management in a search head cluster

Abstract:

Replication of search-related configuration customizations across multiple individual configuration files of search heads of a cluster for a consistent user experience. A search head leader of the cluster can receive a first journal entry relating to a first customization of a knowledge object from a first search head of the cluster. Each search head of the cluster can be configured to perform a reduce phase of a map-reduce search computation. The search head leader may determine the first journal entry references a parent commit journal entry matching a latest commit journal entry in a journal stored in a local data store of the search head leader. The first journal entry can be stored in the journal. A configuration file in the local data store of the search head leader may be updated to include the first journal entry. A communication indicating the updating of the configuration file can be sent to the first search head.