All Apps and Add-ons

How do I make the _internal index of my Cluster Master/License Master available to the S.o.S app running on a different search-head?

fantai_carefirs
Explorer

My License server is on my master node. How do I make the _internal index accessible to SoS on the search head?

hexx
Splunk Employee
Splunk Employee

Very simple: Just follow the documented best practice to forward all data from your cluster master/license master to your indexer.... This will ensure that data from the _internal index of the CM/LM instance is searchable from the search-head where S.o.S is installed.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...