I have a REST call and I am on SH1, and I am trying to follow the REST, but there comes nothing from SH2. Where is the data I am interested located at?
| rest splunk_server=* count=0 /services/saved/searches
the same rest is working ok if executed locally on SH..
Anybody experience the same issue and have a clever solution?
Search heads don't search other search heads (OK, there are exceptions, but they don't apply here). Searches are executed by indexers. If you need data from SH2 then you need to sign in to SH2.
View solution in original post