Search peer + limit indexes

[skippylou]

Is there a way to have only certain indexes searchable when peer'ed with a particular search head?

Example:

Indexer1: Index A and Index B

Indexer2: Index C and Index D

If I have a search head that has both Indexer1 and Indexer2 as distributed search peers, can I have it so that on Indexer2 only Index C is searchable by this search head (essentially keeping this search head from searching Index D)?

Thanks,

Scott

[sbochniewicz]

If you know which indexers have the data you want to search

(splunk_server=IndexerA AND index=indexA) OR (splunk_server=indexerB AND index=B)

[gkanapathy · Accepted solution]

Maybe. Basically, once an indexer allows itself to be searched by the search head, the search head can query any data it wants without restriction. However, you can impose restrictions on what data can be searched by the users of the search head, but you must do so using security and roles settings on the search head itself.

So if you goal is to prevent admins of a search head from querying some of your indexer data, you can't do it. If you goal is to control what users of the search head can see, you can as long as you can set up the right filters and security on the search head itself.

[skippylou]

Gotcha, thanks. Yes, my goal was to limit even administrator users on the search head from querying it. This was a situation where the peers are "owned" by different groups, but that one index on one of the peers both groups would need access to.