All Apps and Add-ons

configuration at Heavy Forwarder instance to forward SavedSearch summary index data at Receiving instance

kalyan_goutham
New Member

Hi Team,

Can you please let me know what should be the configuration done at the heavy Forwarder Splunk instance so that the saved search results that are indexed into the Summary index can be forwarded to the Receiving instance.  Currently, i have configured HF1 to forward data to Search Peer 1.

 

This allows me to route all the Splunk DB Connect query results to Search Peer instance without fail.

However if i have a Saved search created at the HF instance (There is a need to have a saved search configured in my-case at HF), how can the saved search results be routed to the Search Peer. 

Can i configure the HF instance HF1 to be another Search Peer for the Search Peer1 instance  to obtain the data.

Will appreciate any help on this regard.

Labels (1)
0 Karma

anilchaithu
Builder

@kalyan_goutham 

If you want to forward the summary index data to search peer 1, The current configuration to forward data (HF1 -> search peer 1) would suffice for the summary index as well.

 

Hope this helps

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...