Building for the Splunk Platform

I am a Splunk Cloud customer. What is hybrid search and when might it be useful for me?

lagnone_splunk
Splunk Employee
Splunk Employee

What is hybrid search?
What is it used for?
How do I set it up?

1 Solution

lagnone_splunk
Splunk Employee
Splunk Employee

Hybrid search is the use of an on-prem search head to look at data stored in Splunk Cloud.
It can be used for a variety of purposes, the most common are:

*Using custom scripts that are not approved for Splunk cloud
*Using custom inputs not approved for Splunk Cloud.
*Using custom authentication options (2factor, unsupported SSO providers)
*Using apps that are not approved for Splunk Cloud (DB Connect, Cisco Security Suite, etc)

In order to set up hybrid search, you must meet the following requirements

You are a Splunk Cloud stackmaker customer. Customer of single instance (rainmaker) do not have this option.
*Your on-prem search head is *at least
the same version as your Splunk Cloud instance

To get started, please open a support ticket. In order to speed up the process, please provide the following information
*The public IP address of your on-prem search head(s)
*The Splunk version of your on-prem search head(s).

In return, Support will provide you with a set of configurations to apply to your search head.

View solution in original post

lagnone_splunk
Splunk Employee
Splunk Employee

Hybrid search is the use of an on-prem search head to look at data stored in Splunk Cloud.
It can be used for a variety of purposes, the most common are:

*Using custom scripts that are not approved for Splunk cloud
*Using custom inputs not approved for Splunk Cloud.
*Using custom authentication options (2factor, unsupported SSO providers)
*Using apps that are not approved for Splunk Cloud (DB Connect, Cisco Security Suite, etc)

In order to set up hybrid search, you must meet the following requirements

You are a Splunk Cloud stackmaker customer. Customer of single instance (rainmaker) do not have this option.
*Your on-prem search head is *at least
the same version as your Splunk Cloud instance

To get started, please open a support ticket. In order to speed up the process, please provide the following information
*The public IP address of your on-prem search head(s)
*The Splunk version of your on-prem search head(s).

In return, Support will provide you with a set of configurations to apply to your search head.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...