Getting Data In

What are the federated search requirements for remote dataset?

FritzWittwer
Path Finder

I am trying to setup a federated index, on a federated search head, but i am only able to select an index as the remote dataset. the drop down for dataset type does not offer any other option. How do i have to configure the dataset on the remote search head in order to be able to use it on the federated search head.

Bot systems are clustered search heads running Splunk enterprise 8.2.2

Labels (1)
Tags (1)
0 Karma

FritzWittwer
Path Finder

Found the Answer, only indexes can be accessed with a federated search, see Create a federated index

Dataset SpecificationSpecify the Type of remote dataset that this federated index maps to and provide the Object Name for the dataset. Currently, only the Index dataset type is available.

For Object Name you must provide the name of an index that currently exists on the selected federated provider.
The dataset Type defaults to Index.

Object Name has no default.
 
 
 
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...