The easiest way I've found is to create a macro of your query. The use the macro in your dashboard query statement. Be sure permissions are properly set. <query>`your_query`</query> ... View more

Two sites, RF=2 SF=2 + Splunk SmartStore. Design for 3TB/day at one site and 2TB/day at the second site (5TB/day total). Both sites will search across all data. ... View more

Thanks. I can see the benefits and pitfalls of both ways. So if the data is replicated to the remote site (target) to be indexed, assuming two sites, does one need to size the number of indexers based on the combined ingestion rate at both sites? ... View more

Thanks, but after a little further research, that seems inconsistent with https://docs.splunk.com/Documentation/Splunk/;atest/Indexer/Howclusteredindexingworks. Of course this does not specifically address multisite clusters, but I'd assume this would apply. What do you think? ++++++++++++++++++++++++++++++++++++++ These events occur when a peer node starts up: 1. The peer node registers with the master and receives the latest configuration bundle from the master. The master rebalances the primary bucket copies across the cluster and starts a new generation. The peer starts ingesting external data, in the same way as any indexer. It processes the data into events and then appends the data to a rawdata file. It also creates associated index files. It stores these files (both the rawdata and the index files) locally in a hot bucket. This is the primary copy of the bucket. The master gives the peer a list of target peers for its replicated data. For example, if the replication factor is 3, the master gives the peer a list of two target peers. If the search factor is greater than 1, the master also tells the peer which of its target peers should make its copy of the data searchable. For example, if the search factor is 2, the master picks one specific target peer that should make its copy searchable and communicates that information to the source peer. The peer begins streaming the processed rawdata to the target peers specified by the master. It does not wait until its rawdata file is complete to start streaming its contents; rather, it streams the rawdata in blocks, as it processes the incoming data. It also tells any target peer(s) if they need to make their copies searchable, as communicated to it by the master in step 5. The target peers receive the rawdata from the source peer and store it in local copies of the bucket. Any targets with designated searchable copies start creating the necessary index files. The peer continues to stream data to the targets until it rolls its hot bucket. ... View more