Can I do a live search over multiple Splunk indexers?
Yes, 4.1 real-time search is fully distributable.
View solution in original post
You mean real-time search, right? 🙂