Why can I not search from my SHC to my ES SH?

[splunk_luis12]

Hi folks,

How can I search data of my ES SH from the SHC (splunk cloud). Is there a way to do so?

I'm trying to use the | rest /servicesNS/-/-/saved/searches query from my SHC to search the saved searches from my ES SH but I was unable to do so, it seems there is now way of dispatching REST to the ES SH.

What about if I create a summary index with the output of the  | rest /servicesNS/-/-/saved/searches in the ES SH. Will I be able to search that data from my SHC?

I appreciate your help.

[splunk_luis12]

@richgalloway How can I double-check if my SHs share indexers?

Thanks in advance!

[richgalloway]

There are a few ways

• Ask your Splunk admin
• Go to Settings->Distributed Search on both  SHs and compare the search peers listed there.
• Run a search on each SH and compare the splunk_server values returned
• Check the topology in the Monitoring Console

[richgalloway · Accepted solution]

You can't search your ES SH from your SHC because search heads are not search peers for other search heads (except for the Monitoring Console).

You should be able to run the query | rest /servicesNS/-/-/saved/searches from the MC and receive results from all search heads.

Assuming the SHC and ES SH share indexers, the SHC will be able to read a summary index written to by the ES SH.