Splunk Search

How do you search one way between two deployments/environments?


I have inherited an deployment that has multiple environments: PROD, FTI, and oldFTI. I am needing to search from FTI to both prod and oldFTI, but the search can not be done the other way. Can someone point me in the right direction. I am not sure if this is a cluster (don't think so) or search affinity (still not sure).

0 Karma


The first thing you should do before all else is familiarize yourself with your Splunk environment. How things are done can vary greatly depending on whether you have a search head cluster, index cluster, or both (or neither). Read "Inherit a Splunk Enterprise Deployment" (https://docs.splunk.com/Documentation/Splunk/7.2.1/InheritedDeployment/Introduction) a few times.

Once you understand what you have to work with you'll be able to come back with specific questions. In general, you want to add the PROD and oldFTI indexers as search peers to the FTI search head(s). Again, how to do that depends on your configuration. Read Distributed Search (https://docs.splunk.com/Documentation/Splunk/7.1.2/DistSearch/Overviewofconfiguration) and Managing Indexers and Clusters of Indexers (http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Enablethesearchhead).

If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!