topic Re: Distributed Search across multiple "separate" environments in Deployment Architecture

Distributed Search across multiple "separate" environments

MasterOogway — Fri, 25 Feb 2011 11:05:32 GMT

I have two separate Splunk environments: 1) syslog data for platform group 2) network data for LAN & WAN

I don't want Env #1 doing a distributed search to #2 unless we are troubleshooting a specific outage. How can I easily turn on/off distributed searches between separate Splunk environments? Would it be as simple as adding the Indexing server #2 when troubleshooting and removing when done? Or is there a better method to have this capability? And if we have a third environment or fourth environment.....could it easily expand to search them all during troubleshooting times only?

Might be a "feature" for upcoming Splunk versions to offer options to turn "on/off" cross environment searching.

Master Oogway

Re: Distributed Search across multiple "separate" environments

LCM — Fri, 25 Feb 2011 17:54:10 GMT

If nothing is defined (standard), all distributed peers will be searched. However, you'd be able to that with users & roles. Use different users, e.g. standard-user for "normal" use (in this case you have to limitate user/roles priveleges for "normal" user) and like a "debug-user" to troubleshoot (no limitation).

Have a look in these docus

Re: Distributed Search across multiple "separate" environments

karabsze — Fri, 27 Mar 2015 02:53:51 GMT

Seems there is a solution in version 6.2
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Distributedsearchgroups