Hi folks,
How can I search data of my ES SH from the SHC (splunk cloud). Is there a way to do so?
I'm trying to use the | rest /servicesNS/-/-/saved/searches query from my SHC to search the saved searches from my ES SH but I was unable to do so, it seems there is now way of dispatching REST to the ES SH.
What about if I create a summary index with the output of the | rest /servicesNS/-/-/saved/searches in the ES SH. Will I be able to search that data from my SHC?
I appreciate your help.
You can't search your ES SH from your SHC because search heads are not search peers for other search heads (except for the Monitoring Console).
You should be able to run the query | rest /servicesNS/-/-/saved/searches from the MC and receive results from all search heads.
Assuming the SHC and ES SH share indexers, the SHC will be able to read a summary index written to by the ES SH.
@richgalloway How can I double-check if my SHs share indexers?
Thanks in advance!
There are a few ways
You can't search your ES SH from your SHC because search heads are not search peers for other search heads (except for the Monitoring Console).
You should be able to run the query | rest /servicesNS/-/-/saved/searches from the MC and receive results from all search heads.
Assuming the SHC and ES SH share indexers, the SHC will be able to read a summary index written to by the ES SH.