How to configure a local Splunk Server to search indexes on a remote server?

[rbryan_wingspan]

I have a new local install of Splunk that I want to use to develop dashboards without making changes to my production install of Splunk Enterprise.
I'd like for my local Splunk server to run queries against my production data without making a separate copy of the prod data.
Am I trying to make my local Splunk a peer, receiver, or some other term?

[jmallorquin]

Hi,

You have to configure in your local Splunk Settings > Distributed search > Search peers and add the conexion to your indexer.

Hope i help you.

[somesoni2]

To be able to query data from a remote Splunk instance, you can add that Splunk instance (Indexer) as search peer to your local Splunk instance (Search Head). See this for more information on the same.

http://docs.splunk.com/Documentation/Splunk/6.2.6/DistSearch/Configuredistributedsearch

I would suggest to disable/remove can_delete capability from your local Splunk instance/Search head to avoid accidentally deleting production data.