I have read on Splunk.com that Ent. reports don't satisfy use cases the ones on the ES. And that they should not be copied or synched to ES. Please tell me why? Thanks a million
If all of your search heads access the same set of indexers then what is the point of running the same report on SH1 and SH2? Both will get the same results because they have the same data. Run the report on one SH and save the resources on the other SH for a different job.
If all of your search heads access the same set of indexers then what is the point of running the same report on SH1 and SH2? Both will get the same results because they have the same data. Run the report on one SH and save the resources on the other SH for a different job.