All Apps and Add-ons

How do I make the _internal index of my Cluster Master/License Master available to the S.o.S app running on a different search-head?

fantai_carefirs
Explorer

My License server is on my master node. How do I make the _internal index accessible to SoS on the search head?

hexx
Splunk Employee
Splunk Employee

Very simple: Just follow the documented best practice to forward all data from your cluster master/license master to your indexer.... This will ensure that data from the _internal index of the CM/LM instance is searchable from the search-head where S.o.S is installed.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...