Hello Splunkers we have two instances of Splunk with ES (On Prem + Cloud) how to pull all the notables from both the instances in to a single place? i am going through the mothership and es mothership app in splunkbase few clarification: 1. how ES mothership is depends on MOthership app. do we need to do the set up in mothership app which will communicates/send details to ES mothership app? 2. Where we need to install this app? seperate SH or in on prem sh or cloud?   3. what are the other alternative we hvae> can we try federated search for this. will it pull ES notable details?   Thanks D ... View more

Hey Splukers Its a distributed environment. we created index in Cluster Master. We can access the indexes in SH cluster member.. Now I need to create user roles and add specific index to that role //while doing that the indexes created in CM is not listing  then I tried  to check in SH .. setting->indexes.. those indexes not listing.. what could be a reason? Note: in SH i can see the data if i put index=<index >name.. where i need to start my analysis?   ... View more