SOC analyst wants single pane of glass into multi-instance Splunk Enterprise Security

[splunkkrishdee]

Hello Splunkers

we have two instances of Splunk with ES (On Prem + Cloud)

how to pull all the notables from both the instances in to a single place?

i am going through the mothership and es mothership app in splunkbase

few clarification:

1. how ES mothership is depends on MOthership app. do we need to do the set up in mothership app which will communicates/send details to ES mothership app?

2. Where we need to install this app? seperate SH or in on prem sh or cloud?

3. what are the other alternative we hvae> can we try federated search for this. will it pull ES notable details?

Thanks

D

[splunkkrishdee]

Any update on this query?