I want to search on another Splunk instance

[sc0tt]

We have two separate instances of Splunk 6 (A & B) installed on two different servers that are set up independently from each other. I want to search indexes on B from A to display on a live dashboard. Does this require setting up a distributed search? Do I set A as the search head and B as the search peer as described in the Distributed Search docs? Is there anything that I'm missing?

Thanks

[dwaddle · Accepted solution]

That's pretty much it. The "remote" splunk instances that hold the data you want to search have to be added as distributed search peers to the search heads that you want to host the dashboard display on.

[sc0tt]

Thanks again. Everything now seems to be configured properly.

[dwaddle]

You'll need to make one instance of Splunk a license server and have the other be a license slave to it. Having the same license file on different nodes is badness. "Replication" is an often-overloaded term. This could be "bundle replication" which is a feature of distributed search or it could be clustering replication which is something else entirely. And no, distributed search doesn't count against license.

[kristian_kolb]

Oops. Do you have the same license file installed in both machines?

[sc0tt]

Thanks. Does using a distributed search count against the license and what does the replication status "Initial" refer to?