All Apps and Add-ons

configuration at Heavy Forwarder instance to forward SavedSearch summary index data at Receiving instance

New Member

Hi Team,

Can you please let me know what should be the configuration done at the heavy Forwarder Splunk instance so that the saved search results that are indexed into the Summary index can be forwarded to the Receiving instance.  Currently, i have configured HF1 to forward data to Search Peer 1.


This allows me to route all the Splunk DB Connect query results to Search Peer instance without fail.

However if i have a Saved search created at the HF instance (There is a need to have a saved search configured in my-case at HF), how can the saved search results be routed to the Search Peer. 

Can i configure the HF instance HF1 to be another Search Peer for the Search Peer1 instance  to obtain the data.

Will appreciate any help on this regard.

Labels (1)
0 Karma



If you want to forward the summary index data to search peer 1, The current configuration to forward data (HF1 -> search peer 1) would suffice for the summary index as well.


Hope this helps


0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!