Need help on creating a Single Triage dashboard wherein data should be coming from multiple regions of Splunk

[sanju2408de]

We have Splunk Enterprise installed in almost 6 different regions(APAC/AUS/LATAM/EMEA/NA/LA) worldwide and now we are looking for feasibility check for implementing :-

a. Single Triage Dashboard which can be deployed in one region and can be accessing data coming from all these 6 regions.

b. I understand that looking at the current setup we can't access Splunk data from one region to other region. However, is there a possibility through API calls or any other method that we can access other region Splunk data?

Kindly assist us on this topic if anybody can help.

[ITWhisperer]

Have you considered federated searches?

https://www.splunk.com/en_us/blog/platform/introducing-splunk-federated-search.html?locale=en_us

[sanju2408de]

Many thanks for your suggestion, we have not tried this federated search as of now, let us give it a try and see if it works. 

[PickleRick]

Federated searching is one possible approach. Another is to spin up a "central" search head and add all your distributed peers/clusters as search peers. Probably the federated search approach is easier to maintain in the long run.