How to configure a Search Bridge

[taylorgo]

The whitepaper that details a Splunk multi-tenancy architecture describes a "Search Bridge" (https://www.splunk.com/blog/2016/01/22/msaas-a-conceptual-multi-splunk-architecture-framework-for-mu...), where each "tenant" is a separate department or company.

Can anyone point out documentation, or explain how to configure a search head for multiple / separate indexer environments (e.g. Search Bridge)?

Thanks,
Gord T.

[pradeepkumarg]

It's not very different than adding one indexer environment. You set up a new search head layer(bridge) and add your multiple indexers environments to that SH layer.

use distsearch.conf on bridge with all the indexer peers if your indexer segments are not clustered
use server.conf to add all the relevant cluster masters to your search heads in bridge

Do you have any specific questions ?

[adonio]

hello taylorgo,
i think that the meaning of a "Search Bridge" is a search head that can see all different / new indexers, search heads, splunk components in any existing or new environment. I would like to point out that the name of the blog is: MSaaS: A Conceptual Multi-Splunk Architecture Framework for Multitenant Splunk Deployments for MSPs, MSSPs and Enterprises. the paragraph before the white paper start with: "The Multiple Splunk as a Service (MSaaS) technical white paper describes a conceptual framework for designing an MSaaS architecture that supports multitenant Splunk Enterprise deployments as a service."
regardless, the way to achieve this is depends whether the indexers you would like to search (new environment) are clustered or not.
the idea is that for any new environment, all Splunk components sends their internal data to indexers, docs describe how to do so here: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Forwardsearchheaddata
now, you will add new environment's indexers as search peers to the "Search Bridge".
if it is a single indexer, add it as a search peer to the "Search Bridge" from the "Search Bridge" docs here describe how to do it: http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/Configuredistributedsearch
if it is an indexer cluster, add the "Search Bridge" as a Search Head to the Cluster. docs describe how to achieve here:
http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Enablethesearchhead

Hope it helps