We have Splunk Enterprise installed in almost 6 different regions(APAC/AUS/LATAM/EMEA/NA/LA) worldwide and now we are looking for feasibility check for implementing :-
a. Single Triage Dashboard which can be deployed in one region and can be accessing data coming from all these 6 regions.
b. I understand that looking at the current setup we can't access Splunk data from one region to other region. However, is there a possibility through API calls or any other method that we can access other region Splunk data?
Kindly assist us on this topic if anybody can help.
Have you considered federated searches?
https://www.splunk.com/en_us/blog/platform/introducing-splunk-federated-search.html?locale=en_us
Many thanks for your suggestion, we have not tried this federated search as of now, let us give it a try and see if it works.
Federated searching is one possible approach. Another is to spin up a "central" search head and add all your distributed peers/clusters as search peers. Probably the federated search approach is easier to maintain in the long run.