How multiple Splunk Cloud instances work?

[KKuser]

1. For a user to use Splunk support portal, should the user be granted access to the support portal? Don't they get the access inherently?

2. Company has 2 different instances of Splunk. Will the dashboard created in one be visible in another as well? Are the 2 instances independent of each other? Can you paint a picture for me, how they'd be related?

3. In order for me to know the answers to these questions, what concepts/topics should I know well?

[livehybrid]

Hi @KKuser 

1. For a user to use Splunk support portal, should the user be granted access to the support portal? Don't they get the access inherently?

If you have multiple cloud instances within your organisation then these will be covered by individual "entitlements" within the Splunk Support Portal. This means that the operational and organisation contacts can be different for each, and that they shouldnt also be granted to both unless otherwise requested.

For example your IT department might be an operational contact for both, however a user in Department A might be a contact on one, and Department B might be a contact on another.

Users who are configured to use your Splunk instance do not automatically get added to the support portal, this must be done by request to Splunk Support/Account team or by configuration by an existing portal admin in your organisation.

2. Company has 2 different instances of Splunk. Will the dashboard created in one be visible in another as well? Are the 2 instances independent of each other? Can you paint a picture for me, how they'd be related?

No - If you have 2 different instances of Splunk then dashboards and other knowledge objects/searches etc created in one will not automatically replicate to the other, as these are two different instances and not part of a Search Head Cluster. Data can be sent to one independently to the other, or you can have data sent to both. In other words you might find that the different data sources are sent to each, but some could be the same. 

3. In order for me to know the answers to these questions, what concepts/topics should I know well?

Check out the Splunk Cloud Admin training which will give details on how Splunk Cloud works, from getting data in to configuration of users/roles and apps.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[KKuser]

Following on 'by configuration by an existing portal admin in your organisation.'

1.Now I understand that there is Admin role for the Splunk Support portal and I believe it's different from roles for the Splunk instance. Right? 

2.A Splunk enterprise instance admin need not inherently be a Splunk portal admin too. Right? They should be given access to the Support Portal by the support portal admin or Splunk team upon request of the Splunk portal admin. Right?

[livehybrid]

Thats right - Users in the support portal are completely separate to your actual Splunk Instance and are not automatically setup - there is no link between them. Infact you can have users on your Support portal which do not have a login to your Splunk instance if appropriate.

[KKuser]

How to find out whether both Splunk instances are connected or not?

[livehybrid]

Hi @KKuser 

If you are running Splunk Cloud then you might find you have multiple SH, this would mean the addresses are something like es-<stackName>.splunkcloud.com and itsi-<stackName>.splunkcloud.com - In this example they are part of the same deployment.

However, there are other ways that Splunk deployments can be configured and connected, such as multiple SH/SHC as search peers on a single or multisite cluster if on-premise. These SH can be independent to each other but ultimately connect to the same indexers. 

You can also setup federated search between different instances so they can search the same data.

Either way, in these cases users are typically configured independently.

It would be good to understand what you are trying to do, or what information you're trying to pull together, along with any other info you have (e.g. is this a Splunk Cloud, or on-premise deployment)? 
Then I might be able to tailor the advise further.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[KKuser]

I'm operating Splunk cloud. and the addresses are something like abc1.splunkcloud.com and abc2.splunkcloud.com.

I'm trying to get a dashboard in search and reporting app to be visible in both instances. 

1. Are my instances independent of each other?
2. Can I have anything setup so that the dashboard is visible in both instances?
3. following on this 'You can also setup federated search between different instances so they can search the same data.', how can I do it?

[livehybrid]

1. Are my instances independent of each other?
A: Yes - these are independent of each other.

2. Can I have anything setup so that the dashboard is visible in both instances?
A: Im not aware of anything you can do out of the box to automate the sync between the two instances, the only thing you could do is write some custom code to use the Splunk REST API to sync dashboards between them. I would recommend having your dashboards in an app in source control (e.g. Gitlab/Github) and then deploy to both instances to give you the same dashboards on both.

3. following on this 'You can also setup federated search between different instances so they can search the same data.', how can I do it?
A: This is a good starting point (https://www.splunk.com/en_us/blog/platform/introducing-splunk-federated-search.html) which covers the basics of Fed. Search. This wont allow you to sync dashboards, but should give you access to data on either Splunk Cloud stack.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[kiran_panchavat]

@KKuserIt appears that you might be operating two separate Splunk Cloud instances. Please have a look : https://community.splunk.com/t5/Deployment-Architecture/Search-Head-on-Splunk-Cloud/m-p/204981?utm_s... 

[kiran_panchavat]

@KKuser 

Scenario 1: Independent Instances

If the two Splunk instances are completely independent:

• Data ingested into one instance will not be visible in the other. Dashboards, reports, alerts, and searches are all tied to the data present in their respective instances.
• A dashboard created in Instance A will not be visible in Instance B unless manually exported and imported.
  Use Case: This setup is common when different teams or departments need isolated environments or when there are compliance or security boundaries.

Scenario 2: Connected Instances (Search Head Clustering)

If the instances are connected:

• Search Head Clustering: If both instances are part of a search head cluster, dashboards can be shared across the cluster.
• You could manually or automatically sync apps, including dashboards, between the instances.

[KKuser]

How to find out whether both Splunk instances are connected or not?

[kiran_panchavat]

@KKuser 

There are 3 ways to file (or raise) a successful Support Case with Splunk. However you will need to be assigned to your Companies active Enterprise or Global Entitlement before doing so otherwise your case may navigate into our Community Queue which is not often monitored by our Engineers.

1. Support Portal (the best way to file a case)
Login into "splunk.com" and navigate to "Support & Services" on the top left of the page and then click onto "Support Portal" on the drop down list

2. Email
You can email us at "support@splunk.com" which will file a default P3 case. Please note your email address must be associated with your accounts entitlement.

3. Phone
You can call our Support line on (855) SPLUNK-S or you can find local numbers

Contact Information & Splunk Locations | Splunk

[kiran_panchavat]

@KKuser 

Working with Splunk Support

https://www.splunk.com/en_us/pdfs/support/working-with-support.pdf 

[kiran_panchavat]

@KKuser 

1. For a user to use Splunk support portal, should the user be granted access to the support portal? Don't they get the access inherently?

Users need to be granted access to the Splunk Support Portal. Access is not inherent and typically requires an active support entitlement. Users must log in with their credentials to access support resources. The support portal includes license management, support cases, downloads, and other resources that may contain sensitive or licensed information. So, access is usually restricted to certain roles within an organization.

2. Company has 2 different instances of Splunk. Will the dashboard created in one be visible in another as well? Are the 2 instances independent of each other? Can you paint a picture for me, how they'd be related?

Yes, Splunk instances are generally independent of each other unless explicitly configured to share data. A dashboard created in one instance will not be visible in another unless:

• You export and import the dashboard manually.
• You set up search head clustering or data replication between instances.