- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible for a search head cluster to search multiple index clusters?
Is it possible for a search head cluster to search multiple index clusters?
A Solo Searchhead can do so, but I'm not sure with the Searchhead Cluster.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you can.
Here is the doc that shows the configs to do so.
https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Configuremulti-clustersearch
https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCandindexercluster
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Yes, you can have single SH or SH-cluster searching multiple indexers and indexer clusters as well as single indexer/indexer cluster being searched by multiple SHs. Or any combination of those options.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Yes it should be able to. You can configure multiple multisite indexers to be searchable to a SH cluster.
https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Configuremulti-clustersearch
###If it help, kindly consider accepting as an answer/upvote###
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
