Got an interesting dilemma. I work for a large worldwide company. Each site around the world has their own unique set of indexers/clustered search peers for their own domain. I.e. https://lesplunk.lehi.micron.com:8000/ - for the Lehi, UT, USA site.
However, we have some ingestion which is queried by a centralized/worldwide indexer/search head cluster.
I would like to create a dashboard that can run a set of searches local to my domain (Lehi Splunk environment) but also display a single report from a search that must be performed on the worldwide domain (ww Splunk environment).
I’ve tried to use iframe in a panel to get the correct report to show, but I may be messing this one up. The biggest issue I have appears to be regarding the access to the web sites: [web address] refused to connect. Even tried to iframe in www.google.com to see if I could get it to display.
I used this code snippet from another community page reference to test out the iframe feature: <panel> <html> <html> <h2>Example iframe of a dashboard</h2> <p>Uses display controls via the http get param</p> <code> <![CDATA[<iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&hideEdit=true">]]> </code> <iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&hideEdit=true" width="100%" height="400" border="0" frameborder="0"/> </html> </html> </panel>
I know that each instance of Splunk at each of the sites has its own set of login credentials, so I assume that the issue is related to the Lehi Splunk credentials being passed to run the report at the ww Splunk site.
I found this article "Search across multiple indexer clusters" from docs.splunk.com: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Configuremulti-clustersearch - This one says that we could setup our search heads to hit the ww Splunk ingested data, but I think it would apply to ALL sarches from the Lehi Splunk environment and would apply to ALL data that has been ingested in the WW Splunk environment (which I do not want). If this is not how this works, please correct my ignorance. Or if there is way to setup a single dashboard to work in this fashion, please share.
Still nothing, but I did not get the "[web address] refused to connect" error, so I think this might be closer.
I've read through quite a few community pages looking for answers, but if this sounds familiar or you have a page I may have missed, simply direct me to the link. Any suggestions for what to try next? Anyone ever had a similar issue? Any simpler method to insert a report/dashboard from one Splunk server into a dashboard panel of another Splunk server (not in the same cluster)?
If I can provide any more details to help make this clearer, I will happily reply with additional details.