Splunk distributed search between two datacenters

[imacdonald2]

We have two datacenters, Production and QE, each datacenter has a completely seperate AD infrastructure. Our main splunk indexer machine is in our production datacenter. We are running splunk 4.

QE needs access to just a couple indexes on for our production servers.

Am I crazy, will this work?

Set up a search head server that lives in the QE Data center and authenticates users using QE AD domain, it does nothing other than send queries to the main indexer, the main indexer authenticates to using the production AD servers which are completely seperate from the QE ones.

I read in one of the answers on here that in V4 the search head is responsible for all the authentication and authorization and the indexer just trusts that it has been set up correctly, can someone confirm this, if so then it appears my idea will work.

[jensfresson]

What are the requirements regarding network connections between 2 datacenters. Speed, replications etc.
Index clusters between datacenters?
Index servers in only 1 datacenter receiving data from other datacenters. What network performance does that require if you still want to be able to see data "real-time"?

Is there a best practice for this?

[dskillman · Accepted solution]

You are correct. The Search Head controls auth for the search.