Adding a Splunk Search from Another Domain to a Da...

ArchieCrozier · ‎12-07-2020

Got an interesting dilemma. I work for a large worldwide company. Each site around the world has their own unique set of indexers/clustered search peers for their own domain. I.e. https://lesplunk.lehi.micron.com:8000/ - for the Lehi, UT, USA site.

However, we have some ingestion which is queried by a centralized/worldwide indexer/search head cluster.

I would like to create a dashboard that can run a set of searches local to my domain (Lehi Splunk environment) but also display a single report from a search that must be performed on the worldwide domain (ww Splunk environment).

I’ve tried to use iframe in a panel to get the correct report to show, but I may be messing this one up. The biggest issue I have appears to be regarding the access to the web sites: [web address] refused to connect. Even tried to iframe in www.google.com to see if I could get it to display.

I used this code snippet from another community page reference to test out the iframe feature:
    <panel>
<html>
<html>
   <h2>Example iframe of a dashboard</h2>
        <p>Uses display controls via the http get param</p>
        <code>
          <![CDATA[<iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&hideEdit=true">]]>
        </code>
        <iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&hideEdit=true" width="100%" height="400" border="0" frameborder="0"/>
      </html>
      </html>
    </panel>

I know that each instance of Splunk at each of the sites has its own set of login credentials, so I assume that the issue is related to the Lehi Splunk credentials being passed to run the report at the ww Splunk site.

I found this article "Search across multiple indexer clusters" from docs.splunk.com: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Configuremulti-clustersearch - This one says that we could setup our search heads to hit the ww Splunk ingested data, but I think it would apply to ALL sarches from the Lehi Splunk environment and would apply to ALL data that has been ingested in the WW Splunk environment (which I do not want). If this is not how this works, please correct my ignorance. Or if there is way to setup a single dashboard to work in this fashion, please share.

Using the help ffrom this community question "Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage?" (https://community.splunk.com/t5/Dashboards-Visualizations/Feature-Request-How-to-embed-a-dashboard-n...), I tried this:

Still nothing, but I did not get the "[web address] refused to connect" error, so I think this might be closer.

I've read through quite a few community pages looking for answers, but if this sounds familiar or you have a page I may have missed, simply direct me to the link. Any suggestions for what to try next? Anyone ever had a similar issue? Any simpler method to insert a report/dashboard from one Splunk server into a dashboard panel of another Splunk server (not in the same cluster)?

If I can provide any more details to help make this clearer, I will happily reply with additional details.

ArchieCrozier · ‎03-10-2021

No takers on this question, huh?

Adding a Splunk Search from Another Domain to a Dashboard

panel

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

Splunk Smartness with Brandon Sternfield | Episode 3