Yes. Best way is to install in each DC a Universal Forwarder that sends its logs to one or (better) more indexers, eventually clustered (if you need to maintain logs). To search logs you can use an additional search head or (if clustered) one or more indexers. Instead,if you want to store logs on the DC, you have to configure an additional Splunk configured as a Search Head that uses all the DC Splunks as Search peers. To do this, install Splunk on a new machine and configure distributed search adding Search Peers: [Settings -- Distributed Search -- Enable Distributed Search -- Add Search Peers] and restart Splunk. Bye. Giuseppe ... View more

Yes, i was missing the TA on the search head even though it was installed on the remote hosts. Sort of misleading since when you install the TA it says in big red letters (do not install on non *nix) ... View more