https://community.splunk.com/t5/Splunk-Search/Splunk-distributed-search-between-two-datacenters/m-p/15342#M1864 <P>You are correct. The Search Head controls auth for the search.</P> Sat, 12 Jun 2010 02:07:51 GMT dskillman 2010-06-12T02:07:51Z https://community.splunk.com/t5/Splunk-Search/Splunk-distributed-search-between-two-datacenters/m-p/15341#M1863 <P>We have two datacenters, Production and QE, each datacenter has a completely seperate AD infrastructure. Our main splunk indexer machine is in our production datacenter. We are running splunk 4.</P> <P>QE needs access to just a couple indexes on for our production servers.</P> <P>Am I crazy, will this work?</P> <P>Set up a search head server that lives in the QE Data center and authenticates users using QE AD domain, it does nothing other than send queries to the main indexer, the main indexer authenticates to using the production AD servers which are completely seperate from the QE ones.</P> <P>I read in one of the answers on here that in V4 the search head is responsible for all the authentication and authorization and the indexer just trusts that it has been set up correctly, can someone confirm this, if so then it appears my idea will work.</P> Sat, 12 Jun 2010 00:30:33 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-distributed-search-between-two-datacenters/m-p/15341#M1863 imacdonald2 2010-06-12T00:30:33Z https://community.splunk.com/t5/Splunk-Search/Splunk-distributed-search-between-two-datacenters/m-p/15342#M1864 <P>You are correct. The Search Head controls auth for the search.</P> Sat, 12 Jun 2010 02:07:51 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-distributed-search-between-two-datacenters/m-p/15342#M1864 dskillman 2010-06-12T02:07:51Z https://community.splunk.com/t5/Splunk-Search/Splunk-distributed-search-between-two-datacenters/m-p/15343#M1865 <P>What are the requirements regarding network connections between 2 datacenters. Speed, replications etc.<BR /> Index clusters between datacenters? <BR /> Index servers in only 1 datacenter receiving data from other datacenters. What network performance does that require if you still want to be able to see data "real-time"?</P> <P>Is there a best practice for this?</P> Tue, 02 Apr 2013 10:57:41 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-distributed-search-between-two-datacenters/m-p/15343#M1865 jensfresson 2013-04-02T10:57:41Z