Getting Data In

Can all knowledge objects be accessed via 'federation'?


I need to move lots of dashboards, alerts, scheduled reports, lookup tables and data feeds to a new Splunk environment due to security issues.  I would like to make that transition an incremental process rather than one big 'switch over'.

My questions are:

> Which knowledge objects can be accessed via federation?

> What are examples of federated syntax for 'inputlookup', 'loadjob', etc. commands?

I realize there will be a performance impact, but that will be temporary while transition to the new Splunk environment is ongoing.

Where is the current documentation for using federated access?

Thanks in advance.


Labels (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!