Deployment Architecture

separating search heads

a212830
Champion

Hi,

I have a customer who wants to utilize their own search-head to read some Splunk data that I administer. In theory, I have no issues with it. However, we setup this search-head to read the indexers, how do I setup the search-head so that it can read the data, without them knowing the admin password for a distributed search?

Tags (2)

jtrucks
Splunk Employee
Splunk Employee

I did this by managing the SH for them. I installed the software, set up the admin account and the peer accounts, and then gave them non-admin accounts for searching. This has worked quite well in my environment. I just have to make summary indexes for them when they need new ones.

a212830
Champion

Trying to avoid being involved at all - is there any way to do that?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!