We have multiple Splunk instances (webui & indexer) that we manage. They're currently kept isolated by design. However, we're trying to figure out the best way to share searches and distribute searches between the instances with minimal effort.
Basically, we want to create a search/report on SplunkB and see it on SplunkA & SplunkC within a short time frame (0-15minutes would suffice). We'd also like the searches from SplunkA to show up on B&C.
Probably the easiest way is to make sure that everybody savers the searches, then upgrades the permissions of the saved searches to "app" so that each set of associated searches/alerts/KOs is contained inside specific apps. Then use this app to export the entire mess as a single zip file that can be installed on the other search head: