configuration at Heavy Forwarder instance to forward SavedSearch summary index data at Receiving instance

[kalyan_goutham]

Hi Team,

Can you please let me know what should be the configuration done at the heavy Forwarder Splunk instance so that the saved search results that are indexed into the Summary index can be forwarded to the Receiving instance.  Currently, i have configured HF1 to forward data to Search Peer 1.

This allows me to route all the Splunk DB Connect query results to Search Peer instance without fail.

However if i have a Saved search created at the HF instance (There is a need to have a saved search configured in my-case at HF), how can the saved search results be routed to the Search Peer. 

Can i configure the HF instance HF1 to be another Search Peer for the Search Peer1 instance  to obtain the data.

Will appreciate any help on this regard.

[anilchaithu]

@kalyan_goutham 

If you want to forward the summary index data to search peer 1, The current configuration to forward data (HF1 -> search peer 1) would suffice for the summary index as well.

Hope this helps