Getting Data In

How can I pass Splunk output from one Splunk server to another?

Hi,

Is it possible that I have two Splunk servers running one at my office location which has historical data and other one in my laptop which I am carrying. If I fire some query for which data is available at office location but I want the result at my laptop. I understand that I can run Cloud service or have the data on Cloud and do this task easily. But my concern is, that I have slow speed internet on my laptop when I am travelling. So in that case, is it possible that I run a query for which the data is on Splunk server which is at office.

Also, on my laptop some other device will be dumping huge data and I want to correlate the data on laptop and data at my office location. And both locations have different Splunk servers.

Please advice.

0 Karma

Ultra Champion

You can most likely set up distributed searching, so that you configure your laptop Splunk instance to use the office Splunk as a Search Peer. That way it can search both instances and make the correlations.

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration

/K

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!