How to Export Splunk logs to another SH; search differentiation question?

[dkr3500]

This is a two parter:

1.  Is there a way to export Splunk logs from an indexer to an offline Splunk Search Head and conduct searches/create dashboards using those imported logs?  Is there a licensing issue with this approach?

2.  When exporting to the offline SH, I'd like to be able to differentiate which systems I'm searching/viewing in the dashboards - but my different test/dev/prod instances of the UFs that I'm pulling logs from will have the same IP address and hostnames.  Is there a way to differentiate which instance I'm searching/viewing when dumping those logs into the offline SH?

Thank you.

[woodcock]

Yes, you could, but it really doesn't make sense.  You can just directly peer the new Search Head to every/any Indexer.  You can discriminate what lives/came-from where by examining the "splunk_server" value.  So whatever you do, you can add a splityby (... BY splunk_server) to keep the results separated.

[dkr3500]

Good day @gcusello! 

As always, thank you for setting me straight.  I forgot that that little important fact; the exported logs would still need to be exported to another indexer.

As for the second part of my question, please let me clarify.  I will have 3 different Splunk Enterprise environments, all identical to each other but completely segregated.  Is there a way I can put the raw logs from all 3 Splunk Enterprise environments into an offline Splunk Enterprise indexer/SH and still be able to differentiate which logs/searches/dashboard data is from which of the 3 environments?

Thank you sir!

[gcusello]

Hi @dkr3500,

you can configure your stand-alone server as Search Head of all three systems.

When you run a search, you have a field "splunk_server" that tells you what's the Indexer where data are stored.

Ciao.

Giuseppe

[gcusello]

Hi @dkr3500,

by definition a Search Head is a Splunk Server that send searches to the Indexers, it does't have archived logs!

If you mean to send some logs to a stand-alone server to use for testing, you should extract logs in raw format from the production Indexers (using e.g. one of the Production Search Heads) and manually load them in the stand-alone server, but you need to reindex them, paying twice the license.

If you have to use the production logs only for development, you could use a Search Head, out of your production SHC and use it to develop dashboards and apps using the production data, but you have to protect it to avoid unwanted accesses to your production data.

Ciao.

Giuseppe