How to search across multiple Data Centers in a clustered environment?

[sat94541]

I have two Data Centers: one in New York (NY) and other in San Francisco (SF) city.
We have a Cluster Master , Search Head and Cluster Peers in NY City
We also have a separate Cluster Master, Search Head and Cluster Peers in SF.

• We are able to use the Search Head (NY) to search the Cluster Peers (NY)
• Also, we are able to use the Search Head (SF) to search the Cluster Peers (SF)

Now our next requirement is to be able to use the Search Head (NY) to search both (NY) Cluster Peers and (SF) Cluster Peers.
We also need to be able to use the Search Head (SF) to search both (NY) Cluster Peers and (SF) Cluster Peers.

Which ports do I need to enable?

[rbal_splunk · Accepted solution]

Here is what I will do

i) Login to Search Head(NY) and navigate to Setting> Clustering and add the Cluster Master(SF). For this to work, you should be able to telnet to Cluster Master (SF) and Cluster Peer(SF) from Search Head (NY)

ii) Also, login to Search Head(SF) and navigate to Setting> Clustering and add the Cluster Master(NY). For this to work you should be able to telnet to Cluster Master (NY) and Cluster Peer(NY) from Search Head (SF)

Once above steps are done, you can verify the peers being searched using the search below

---From Search Head(NY)------
Index=_internal | dedup splunk_server | table Splunk_server
This should show all peers from Data Center (NY) and (SF)

----From Search Head (SF)----
Index=_internal | dedup splunk_server | table Splunk_server
This should show all peers from Data Center (NY) and (SF)