In our enterprise, there is already another team which has setup Splunk Search Heads and Indexers in their own AWS account (say A). We are planning to index and store new data in our AWS account (say B). For our dashboards, we would like to pull in data indexed in Account A as well. So, trying to determine the best approach here 1. Is is possible to setup Search Heads in Account B and add indexers to it from account B and A as well ? 1.1. In such case, will existing setup in Account A get affected any way? Overall, is it possible to share indexers across multiple AWS accounts and still maintain its own Search Heads and dashboard UI ? As we are different teams, we would like to have independence in maintaining our dashboards/splunk enterprise instances and also not share indexed confidential data. The documentation here lists command to edit indexer cluster config but not add a new search head from other aws account. So, it would be helpful to know if its possible to share indexes across aws accounts. https://docs.splunk.com/Documentation/Splunk/8.2.5/DistSearch/SHCandindexercluster
... View more