Getting Data In

Can all knowledge objects be accessed via 'federation'?


I need to move lots of dashboards, alerts, scheduled reports, lookup tables and data feeds to a new Splunk environment due to security issues.  I would like to make that transition an incremental process rather than one big 'switch over'.

My questions are:

> Which knowledge objects can be accessed via federation?

> What are examples of federated syntax for 'inputlookup', 'loadjob', etc. commands?

I realize there will be a performance impact, but that will be temporary while transition to the new Splunk environment is ongoing.

Where is the current documentation for using federated access?

Thanks in advance.


Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!