Wondering if it is possible to have our indexer in our datacenter but another splunk server to show graphs and do the searching at our office? So like maybe the indexed data gets sent over to that other splunk server in the office.
It sounds like what you want is a search head. Read more about it here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/ComponentsofaSplunkdeployment#Search... http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/Whatisdistributedsearch
View solution in original post
perfect.. thanks
