We are looking at merging Splunk instances between different data centers and having a single Search head cluster.
Frank would you be using distributed search feature or are you configuring the web.conf on the search head to reach back to a different splunkd instance running on your indexer?
Frank would you be using distributed search feature or are you configuring the web.conf on the search head to reach back to a different splunkd instance running on your indexer?
I would be using a distributed search.
I am not sure what the difference between your two questions.