Federated Search setup overview

Set up a Splunk Validated Architecture (SVA) C3 federated search deployment between two search head clusters.

In this Splunk Validated Architecture (SVA) C3 setup, a LOCAL search head cluster searches indexes on a REMOTE search head cluster. The examples assume Azure Blob Storage for App Framework distribution. They also assume Ingress NGINX for the management path between clusters.

If you don't use Azure, use the manual deployment path or adapt the App Framework configuration to your object store. If you don't use Ingress NGINX, translate the ingress example and annotations to the equivalent configuration for your controller.

Standard mode federated search is the only topology covered here; transparent mode and mixed VM/Kubernetes topologies are out of scope.

For more information about this architecture, see SVA C3.

Figure 1. Federated search setup architecture
Architecture diagram showing a LOCAL search head cluster querying a REMOTE search head cluster over a federated provider connection.

Key concepts

LOCAL search head cluster
The search head cluster where users run searches.
REMOTE search head cluster
The search head cluster that provides access to remote data.
Federated provider
Configuration that defines how to connect to the REMOTE cluster.
Federated index
A virtual index that maps to a real index on the REMOTE cluster.
Service account
A dedicated user, fsh_svc, for federated search authentication.

Infrastructure requirements

  • A Kubernetes cluster with Splunk Operator deployed
  • Two separate SearchHeadCluster custom resources, one LOCAL and one REMOTE
  • IndexerCluster custom resources connected to both search head clusters
  • Azure Blob Storage plus the required identity or secret configuration if you use the App Framework path
  • Direct access to the LOCAL search head cluster pods if you use the manual deployment path

Network requirements

  • HTTPS connectivity between the LOCAL and REMOTE search head clusters
  • A Kubernetes service that exposes the REMOTE management endpoint inside the cluster
  • Ingress NGINX (if you want to use the provided ingress manifests without modification)

Splunk requirements

  • A Splunk Enterprise version supported by your Splunk Operator release
  • Federated search enabled on both clusters
  • Administrative access to both clusters