Splunk Search

How to search across multiple Data Centers in a clustered environment?

sat94541
Communicator

I have two Data Centers: one in New York (NY) and other in San Francisco (SF) city.
We have a Cluster Master , Search Head and Cluster Peers in NY City
We also have a separate Cluster Master, Search Head and Cluster Peers in SF.

  • We are able to use the Search Head (NY) to search the Cluster Peers (NY)
  • Also, we are able to use the Search Head (SF) to search the Cluster Peers (SF)

Now our next requirement is to be able to use the Search Head (NY) to search both (NY) Cluster Peers and (SF) Cluster Peers.
We also need to be able to use the Search Head (SF) to search both (NY) Cluster Peers and (SF) Cluster Peers.

Which ports do I need to enable?

1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Here is what I will do

i) Login to Search Head(NY) and navigate to Setting> Clustering and add the Cluster Master(SF). For this to work, you should be able to telnet to Cluster Master (SF) and Cluster Peer(SF) from Search Head (NY)

ii) Also, login to Search Head(SF) and navigate to Setting> Clustering and add the Cluster Master(NY). For this to work you should be able to telnet to Cluster Master (NY) and Cluster Peer(NY) from Search Head (SF)

Once above steps are done, you can verify the peers being searched using the search below

---From Search Head(NY)------
Index=_internal | dedup splunk_server | table Splunk_server
This should show all peers from Data Center (NY) and (SF)

----From Search Head (SF)----
Index=_internal | dedup splunk_server | table Splunk_server
This should show all peers from Data Center (NY) and (SF)

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Here is what I will do

i) Login to Search Head(NY) and navigate to Setting> Clustering and add the Cluster Master(SF). For this to work, you should be able to telnet to Cluster Master (SF) and Cluster Peer(SF) from Search Head (NY)

ii) Also, login to Search Head(SF) and navigate to Setting> Clustering and add the Cluster Master(NY). For this to work you should be able to telnet to Cluster Master (NY) and Cluster Peer(NY) from Search Head (SF)

Once above steps are done, you can verify the peers being searched using the search below

---From Search Head(NY)------
Index=_internal | dedup splunk_server | table Splunk_server
This should show all peers from Data Center (NY) and (SF)

----From Search Head (SF)----
Index=_internal | dedup splunk_server | table Splunk_server
This should show all peers from Data Center (NY) and (SF)

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!