topic Cooperation between multiple splunk in Deployment Architecture

Cooperation between multiple splunk

krugger — Mon, 08 Apr 2013 14:17:49 GMT

I have a working splunk server that has several indexes. I found out there is another department that is also using splunk, so I would like to use my splunk to search their splunk.

I was looking into distributed search, but it appear we would have to have a common shared folder to store our indexes.

What is the proper way to make the remote indexes appear in my splunk? I don't want all of them only a few.

I guess I have to configure my search head to go and query the remote splunk indexer. Any pointers on that?

Edit:
With distributed search enabled it seems every single search is also being done on the remote peer. How do I stop this from happening?

Re: Cooperation between multiple splunk

okrabbe_splunk — Mon, 08 Apr 2013 14:39:17 GMT

You would configure distribued search:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuredistributedsearch

These easiest way to configure is probably through using the web UI.

Also, be sure to read about how authorization works for distributed searches so that you will be able to actually search the other indexer:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Howauthorizationworksindistributedsearches

Re: Cooperation between multiple splunk

alacercogitatus — Mon, 08 Apr 2013 14:39:49 GMT

Distributed search doesn't have to have the same index folders. You can set the other department as a search peer, and just specifiy index=foo for the ones you need off of their indexer. As long as any custom extractions are in both places, you should be ok with doing it this way.

Re: Cooperation between multiple splunk

rmcdougal — Mon, 08 Apr 2013 14:40:34 GMT

It should be as easy as adding their indexer as a search peer to your search head. Other than ensuring the management port is open between the two, that should be it.

Re: Cooperation between multiple splunk

krugger — Mon, 08 Apr 2013 16:11:17 GMT

each splunk has its own custom extractions, as we are indexing different systems.