Getting Data In

One search head to search across two separate indexer clusters?

varunmalhotra1
Explorer

I am running two setups of Splunk, one is in Datacenter and another is in AWS.

DC : 2 Node search heads, 3 nodes : indexers, 1 deployment server & license manager
AWS : 2 Node search heads, 3 nodes : indexers, 1 deployment server & license manager

I am trying to add AWS indexer cluster to DC search head. If this is possible we will stop the AWS hosted SHs because we want to keep only one SH cluster which should be able to search across two distinct indexer clusters.
Please note that there is no replication or any connection between the AWS hosted and DC hosted indexer cluster. We don't want to setup multisite indexer clustering.

Can this be done ?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can add any number of search peers to a search head (non-clustered indexers), or add search heads to any number of cluster masters (clustered indexers).
Then a search will run over all indexers, giving you unified results.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...