Distrubuted search across specific data

[Hazel]

Hello,

We currently have a Splunk setup as follows

• UAT: Three indexers (NY, LDN, SGP), each collect data from forwarders in their regions and then searches from each region also distribute across the other two regions, allowing us to get global data from each search head.

• Prod: Similar setup to UAT.

The problem I have now is that I have some servers that are both my UAT and my Disaster Recovery for Production. They contain some files for UAT, which I want to search in UAT Splunk and some files for DR that I want to search in my Splunk Production.

I know that we could tell our Splunk Production to do a distributed search across UAT servers also in order to get the DR data i need, but I don't really want all UAT data also in Production, is there a way to limit it?

Is there a way to tell our Splunk Production to a distributed search across specific indexes on a server so I can get just some of the data currently going to UAT (ie the DR data) into Splunk Production without taking it all?

[gkanapathy]

Regardless of what server the data comes from, the default and allowed indexes will be defined by roles on the search head. So perhaps it will be possible to name your indexes differently across the various systems and to have DR data in a differently-named index that is nevertheless in the default search for a role.

If you can't have multiple indexes, or ones with different names, you could perhaps achieve something similar with the role search filters, which are also applied according to roles on the search head.

[Hazel]

I still don't understand this. They are in different indexes, but they are on different indexers, reporting to different search heads... so how can this work?

[gkanapathy]

Put the data that must be accessed differently in different indexes, and configure the default indexes for each role (on each search head) to query a different set of indexes as appropriate.

[Hazel]

This answer has been voted up but it does not answer my question. The answer relates to splitting out data over a search head but my question relates to data that is sent to different search heads.

[Hazel]

Hi, I'm not sure I understand your answer. The issue here as that the UAT data is indexed to one server and available on one search head and the Production data is indexed to one server and availabled on the Production search head. UAT and Production are not connected, they are different systems and setups. But, I need to get my UAT data, into the Production searches