How to use a common SH view for my 2 cloud splunk Instance ?

[vikas_gopal]

Hi Experts,

I have 2 Splunk cloud setup one for Europe and other is for USA . How can I give a common layer (SH) in this case ?

Regards
VG

[richgalloway]

Perhaps the Mothership app (https://splunkbase.splunk.com/app/4646/#/details) will fill your needs. I've never used it, so I can't offer any experiences with it.

[vikas_gopal]

Thanks for the answer Rich,
Here I have one concer , Where this app go I mean i know this will be on SH but on which cloud instance on Europe or USA splunk Cloud . Or you are saying I need to setup on prim SH like a hybrid SH and then Install this app there and it will pull details from both the Cloud instances ?

[richgalloway]

Like I said, I have no experience with this app. I would install it on an on-prem SH, if you can.

[richgalloway]

Is this Splunk Cloud (that is, managed by Splunk) or some Splunk instances you've installed in a cloud service?
Are the two setups connected in any way?

[vikas_gopal]

It is pure play Splunk Cloud managed by Splunk . The only thing that I can manage is HF,UF , DS etc and both are not connected as of now . That is what the requirement is to show both on common SH layer.

[richgalloway]

And by "show both on common SH" do you mean a user should be able to sign in to this new SH and search data from either Cloud instance? Or something else?

[vikas_gopal]

yeah something similar , see customer is asking how both cloud setups can be seen from single pane of glass . But we know from Splunk prespective this mean common SH which can search both the Cloud instances indexers and prepare common dashboards .

[splunkkrishdee]

@vikas_gopal 

did you able to find solution for this?have you configured ES mothership app before?

if so need some inputs for that.