topic Re: one-way distributed searches in Splunk Search

one-way distributed searches

amrit — Thu, 21 Jan 2010 12:27:22 GMT

Given servers A and B, how do you search both A AND B from server A, but disallow B from searching against A?

Re: one-way distributed searches

matt — Thu, 21 Jan 2010 12:42:56 GMT

Remove server A from the peer list in server B's distsearch.conf. Docs have an example here

Re: one-way distributed searches

gkanapathy — Thu, 21 Jan 2010 13:36:25 GMT

Distributed search is always configured one way at a time, from a search head node to an index node. If you configure A to be allowed to search B, server B will not be able to search A (unless you specifically perform the configuration steps to do so).

If server B is already able to search server A, then in addition to removing A from server B's distsearch.conf file, you should also remove server B's authorized key from server A's $SPLUNK_HOME/etc/auth/distSearchKeys/ folder. If you do not do so, then an administrator of B (who is not an administrator of A) can regain access to A simply by adding A back to the distsearch.conf file.

Re: one-way distributed searches

sophy — Tue, 22 Jun 2010 23:57:49 GMT

matt, i think you meant to link this page in the documentation, "Configure distributed search".

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configuredistributedsearch