Splunk Search

How do you search one way between two deployments/environments?

cboillot
Contributor

I have inherited an deployment that has multiple environments: PROD, FTI, and oldFTI. I am needing to search from FTI to both prod and oldFTI, but the search can not be done the other way. Can someone point me in the right direction. I am not sure if this is a cluster (don't think so) or search affinity (still not sure).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first thing you should do before all else is familiarize yourself with your Splunk environment. How things are done can vary greatly depending on whether you have a search head cluster, index cluster, or both (or neither). Read "Inherit a Splunk Enterprise Deployment" (https://docs.splunk.com/Documentation/Splunk/7.2.1/InheritedDeployment/Introduction) a few times.

Once you understand what you have to work with you'll be able to come back with specific questions. In general, you want to add the PROD and oldFTI indexers as search peers to the FTI search head(s). Again, how to do that depends on your configuration. Read Distributed Search (https://docs.splunk.com/Documentation/Splunk/7.1.2/DistSearch/Overviewofconfiguration) and Managing Indexers and Clusters of Indexers (http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Enablethesearchhead).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...