Federated search quick reference

Commands for common federated search tasks, plus links to related documentation and support resources.

Use these kubectl commands to perform common federated search tasks.

Set helper variables

CODE 
NAMESPACE="stos-auto"
LOCAL_POD=$(kubectl -n $NAMESPACE get pods \
  -l app.kubernetes.io/instance=splunk-local-shc-search-head \
  -o jsonpath='{.items[0].metadata.name}')

Get the admin password

CODE 
kubectl -n $NAMESPACE get secret splunk-local-shc-search-head-secret-v1 \
  -o jsonpath='{.data.password}' | base64 -d

Test federated search

CODE 
kubectl -n $NAMESPACE exec $LOCAL_POD -c splunk -- curl -sk \
  -u admin:<password> -X POST "https://localhost:8089/services/search/jobs?output_mode=json" \
  -d "search=search index=federated:r_audit | stats count" -d "exec_mode=oneshot"

Check the provider configuration

CODE 
kubectl -n $NAMESPACE exec $LOCAL_POD -c splunk -- \
  /opt/splunk/bin/splunk btool federated list

Check the index configuration

CODE 
kubectl -n $NAMESPACE exec $LOCAL_POD -c splunk -- \
  /opt/splunk/bin/splunk btool indexes list | grep federated

Restart search head cluster pods

CODE 
kubectl -n $NAMESPACE delete pod -l app.kubernetes.io/instance=splunk-local-shc-search-head

Additional resources

Support

For issues or questions:

  1. Check the relevant troubleshooting topic:

  2. Review Splunk logs at /opt/splunk/var/log/splunk/.
  3. Check operator logs:
    CODE 
    kubectl -n splunk-operator logs -l control-plane=controller-manager
  4. Consult the Splunk community forums.