Create standard mode federated providers that have the same host name but different app contexts

If a standard mode federated provider has the Search app as its app context, federated searches, the portions of federated searches that run over that provider can use or reference only the tags, aliases, search-time field extractions, and other knowledge objects that are associated with the Search app. If you run a federated search that references an alias or calculated field that is associated with another app, it fails on the federated provider because it can't find those knowledge objects in the Search app.

Remedy this problem by creating multiple standard mode federated provider definitions that use the same host and port but which have different app contexts. You can do this as long as each federated provider configuration has a unique name. For example, you can use the following three standard mode federated provider configurations concurrently even though they all search data on the same remote host:

Federated provider name Remote host Application short name
buttercupgames-search buttercup.games.splunkcloud.com:8089 search
buttercupgames-custom1 buttercup.games.splunkcloud.com:8089 your_custom_app1
buttercupgames-custom2 buttercup.games.splunkcloud.com:8089 your_custom_app2

You can set up multiple standard mode providers with the same host and port as long as they have different provider names.

See Define a Splunk platform federated provider.