Splunk Search

How do you search one way between two deployments/environments?


I have inherited an deployment that has multiple environments: PROD, FTI, and oldFTI. I am needing to search from FTI to both prod and oldFTI, but the search can not be done the other way. Can someone point me in the right direction. I am not sure if this is a cluster (don't think so) or search affinity (still not sure).

0 Karma


The first thing you should do before all else is familiarize yourself with your Splunk environment. How things are done can vary greatly depending on whether you have a search head cluster, index cluster, or both (or neither). Read "Inherit a Splunk Enterprise Deployment" (https://docs.splunk.com/Documentation/Splunk/7.2.1/InheritedDeployment/Introduction) a few times.

Once you understand what you have to work with you'll be able to come back with specific questions. In general, you want to add the PROD and oldFTI indexers as search peers to the FTI search head(s). Again, how to do that depends on your configuration. Read Distributed Search (https://docs.splunk.com/Documentation/Splunk/7.1.2/DistSearch/Overviewofconfiguration) and Managing Indexers and Clusters of Indexers (http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Enablethesearchhead).

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...