Hi,
Thanks for any inputs,
Dinesh
Just to throw an additional idea into the mix..
Why do you have separate SHCs?
If its to do with performance and preventing users on one SHC consuming resources on the others, you might look at the new Workload Management functionality which came with 7.2 https://docs.splunk.com/Documentation/Splunk/7.2.3/Workloads/Aboutworkloadmanagement
Overall, you would probably see a significant performance improvement by combining all of your searcheads into one cluster and using Workload management to share the resources according to your needs.
It would also give you only 1 url for all your users to reach.
What is behind those 3 different URLs? 3 different standalone search heads?
Do I understand it correctly that you basically want a common URL, and then redirect users based on their username to the respective splunk instance?
It's quite common to put a loadbalancer in front of your search heads / search head cluster. But I'm not sure if there are load balancers that can direct specific users to specific endpoints...
Thanks @FrankVl
The three different URL's that I gave are itself LB's and underneath that we 3 or 4 search heads. For example
https://splunk1.com will have 3 search head, they are integrated via SHC
https://splunk2.com will have 2 or 4 search head, they are integrated via SHC like wise
Yes I want a common URL, so that when specific user who access a particular search ui should be directed to that UI without showing him the UI change (like implementing a .htaccess redirect rule in apache)
Is this something doable or any ideas how to come up with a single interface?
Thanks,
Dinesh
I guess that would very much depend on the capabilities of the load balancing solution you have at your disposal. So would be good if you can perhaps share what load balancer you use?
I'm not much of an expert on that, this is also not really a splunk question, but perhaps there are people here that can still provide some suggestions.