Splunk Enterprise version 8.1 will no longer be supported as of April 19, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.Download topic as PDF
The following are the spec and example files for
# Version 8.1.7 # # This file contains possible setting and value pairs for federated provider entries # for use in Data Fabric Search (DFS), when the federated search functionality is # enabled. # # A federated search allows authorized users to run searches across multiple federated # providers. Only Splunk deployments are supported as federated providers. Information # on the Splunk deployment (i.e. the federated provider) is added in the federated # provider stanza of the federated.conf file. A federated search deployment can have # multiple federated search datasets. The settings for federated search dataset stanzas # are located in savedsearches.conf. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles # # Here are the settings for the federated provider stanzas.
* Create a unique stanza name for each federated provider. type = [splunk] * Specifies the type of the federated provider. * Only Splunk deployments are supported as of this revision. * Default: splunk ip = <IP address> * Identifies the IP address of the federated provider. * No default. splunk.port = <port> * Identifies the splunkd REST port on the remote Splunk deployment. * No default. splunk.serviceAccount = <user> * Identifies an authorized user on the remote Splunk deployment. * The security credentials associated with this account are managed securely in fshpasswords.conf. * No default. splunk.app = <string> * The name of the Splunk application on the remote Splunk deployment in which * to perform the search. * No default.
# Version 8.1.7 # # This is an example federated.conf. # # ## Federated Providers [deployment-sf-search] type = splunk ip = 192.0.2.0 splunk.port = 8089 splunk.serviceAccount = sf-search splunk.app = search [deployment-sf-hr] type = splunk ip = 192.0.2.0 splunk.port = 8089 splunk.serviceAccount = sf-hr splunk.app = search [deployment-sr-search] type = splunk ip = 198.51.100.0 splunk.port = 8089 splunk.serviceAccount = sf-search splunk.app = search
Last modified on 17 November, 2021
This documentation applies to the following versions of Splunk® Enterprise: 8.1.7
Feedback submitted, thanks!