Searching across multiple standalone indexers without data replication / indexer clustering

[vinitatsky]

I have 6 different DCs with standalone Splunk ENT installed working as indexers and no replication for security reasons.

Need to configure a SH to search across different DCs? Is this a preferred solution?

Can I configure stand alone Splunk (working as SH and IDX in local) to index local data only and search across different DCs, if required?

Any possible suggestions please.

[gcusello]

Yes.
Best way is to install in each DC a Universal Forwarder that sends its logs to one or (better) more indexers, eventually clustered (if you need to maintain logs).
To search logs you can use an additional search head or (if clustered) one or more indexers.

Instead,if you want to store logs on the DC, you have to configure an additional Splunk configured as a Search Head that uses all the DC Splunks as Search peers.
To do this, install Splunk on a new machine and configure distributed search adding Search Peers:
[Settings -- Distributed Search -- Enable Distributed Search -- Add Search Peers] and restart Splunk.
Bye.
Giuseppe

[mrybar]

Since you are looking for any and all suggestions, one might be to set each indexer up as a cluster of 1, then configure the search head to search across multiple indexer clusters this will work for multisite.

[gwobben]

Sure you can, not really preferred though because if one indexer is down, you cannot search all of your data.

If you really want to you can:
- Settings
- Distributed search
- Search peers
- New
- Fill out the form
- Repeat for all the nodes