Multisite DAG Exchange 2010

[zivrivkis]

We have a multisite DAG and Splunk seems to treat 2 sites of the DAG as different clusters. Under Operations>Systems>Clustering it displays primary site with 3 Exchange servers in DAG as a single DAG cluster and the DR site as a seperate cluster. Is there a way to combine the 2 clusters into 1?

[ahall_splunk · Accepted solution]

This is because exchange 2010 treats this as two separate clusters within the topology. You will need to alter the underlying searches to create custom segmentation.