How do you search one way between two deployments/environments?

[cboillot]

I have inherited an deployment that has multiple environments: PROD, FTI, and oldFTI. I am needing to search from FTI to both prod and oldFTI, but the search can not be done the other way. Can someone point me in the right direction. I am not sure if this is a cluster (don't think so) or search affinity (still not sure).

[richgalloway]

The first thing you should do before all else is familiarize yourself with your Splunk environment. How things are done can vary greatly depending on whether you have a search head cluster, index cluster, or both (or neither). Read "Inherit a Splunk Enterprise Deployment" (https://docs.splunk.com/Documentation/Splunk/7.2.1/InheritedDeployment/Introduction) a few times.

Once you understand what you have to work with you'll be able to come back with specific questions. In general, you want to add the PROD and oldFTI indexers as search peers to the FTI search head(s). Again, how to do that depends on your configuration. Read Distributed Search (https://docs.splunk.com/Documentation/Splunk/7.1.2/DistSearch/Overviewofconfiguration) and Managing Indexers and Clusters of Indexers (http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Enablethesearchhead).