Splunk Search

Searching across multiple standalone indexers without data replication / indexer clustering

vinitatsky
Communicator

I have 6 different DCs with standalone Splunk ENT installed working as indexers and no replication for security reasons.

Need to configure a SH to search across different DCs? Is this a preferred solution?

Can I configure stand alone Splunk (working as SH and IDX in local) to index local data only and search across different DCs, if required?

Any possible suggestions please.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes.
Best way is to install in each DC a Universal Forwarder that sends its logs to one or (better) more indexers, eventually clustered (if you need to maintain logs).
To search logs you can use an additional search head or (if clustered) one or more indexers.

Instead,if you want to store logs on the DC, you have to configure an additional Splunk configured as a Search Head that uses all the DC Splunks as Search peers.
To do this, install Splunk on a new machine and configure distributed search adding Search Peers:
[Settings -- Distributed Search -- Enable Distributed Search -- Add Search Peers] and restart Splunk.
Bye.
Giuseppe

0 Karma

mrybar
Explorer

Since you are looking for any and all suggestions, one might be to set each indexer up as a cluster of 1, then configure the search head to search across multiple indexer clusters this will work for multisite.

0 Karma

gwobben
Communicator

Sure you can, not really preferred though because if one indexer is down, you cannot search all of your data.

If you really want to you can:
- Settings
- Distributed search
- Search peers
- New
- Fill out the form
- Repeat for all the nodes

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...