Splunk Search

I want to search on another Splunk instance

Builder

We have two separate instances of Splunk 6 (A & B) installed on two different servers that are set up independently from each other. I want to search indexes on B from A to display on a live dashboard. Does this require setting up a distributed search? Do I set A as the search head and B as the search peer as described in the Distributed Search docs? Is there anything that I'm missing?

Thanks

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

That's pretty much it. The "remote" splunk instances that hold the data you want to search have to be added as distributed search peers to the search heads that you want to host the dashboard display on.

View solution in original post

SplunkTrust
SplunkTrust

That's pretty much it. The "remote" splunk instances that hold the data you want to search have to be added as distributed search peers to the search heads that you want to host the dashboard display on.

View solution in original post

Builder

Thanks again. Everything now seems to be configured properly.

0 Karma

SplunkTrust
SplunkTrust

You'll need to make one instance of Splunk a license server and have the other be a license slave to it. Having the same license file on different nodes is badness. "Replication" is an often-overloaded term. This could be "bundle replication" which is a feature of distributed search or it could be clustering replication which is something else entirely. And no, distributed search doesn't count against license.

Ultra Champion

Oops. Do you have the same license file installed in both machines?

0 Karma

Builder

Thanks. Does using a distributed search count against the license and what does the replication status "Initial" refer to?

0 Karma