Splunk Search

Can Splunk Federated Search be configured for bidirectional search?

meetmshah
Builder

I want to configure Federated Search so that Deployment A can search Deployment B, and Deployment B can also search Deployment A. I understand that Federated Search is typically unidirectional (local search head → remote provider). Is it possible to configure it for true bidirectional searches in a single architecture (create two separate unidirectional configurations (A→B and B→A))?

Has anyone implemented this setup successfully? Any best practices or caveats would be appreciated.

Also, have anyone implemented this along with ITSI - what are the takeaways and do & don'ts?

Labels (1)
0 Karma

PrewinThomas
Builder

@meetmshah 

I haven't tested this personally. But theoratically by creating two separate unidirectional configurations its feasible. Deployment A acts as a Federated Search Head with Deployment B as its Federated Provider and deployment B also acts as a Federated Search Head with Deployment A as its Federated Provider.

As per document Real-time searches are not supported in Federated Search mode.
#https://docs.splunk.com/Documentation/ITSI/4.20.1/EA/FedSearch

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

0 Karma

meetmshah
Builder

Thanks for the answer @livehybrid. With respect to - "Yes two different deployments can be fed. search clients for eachother"? - Have you seen an environment with the same? Because I couldn't find any of the Splunk Doc where it's mentioned that the environments can be interconnected.

0 Karma

livehybrid
Ultra Champion

Hi @meetmshah 

Yes two different deployments can be fed. search clients for eachother - however the connections will not really know of each other. 

I dont know too much about the best practices here, however *Federated Search for Splunk supports Splunk IT Service Intelligence version 4.16.0 and higher, for transparent mode federated search only* based on the docs.

Note - the federated search docs suggest engaging with your account team and/or support when working with premium apps such as ITSI with federated search.

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...