Splunk® Enterprise

Search Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Migrate from hybrid search to federated search

Do you run hybrid searches from your Splunk Enterprise search head that combine data from your Splunk Enterprise instance with data from a Splunk Cloud Platform environment? Now you can migrate your hybrid searches to the federated search solution. Federated search expands your cross-deployment search capabilities.

Comparing hybrid search and federated search

The following table shows you how hybrid search and transparent mode federated search match up.

Feature Hybrid search Federated search in transparent mode
Environments spanned in a search Hybrid searches can span a single Splunk Enterprise deployment and a single Splunk Cloud Platform deployment. Transparent mode federated searches can span a single Splunk Enterprise deployment and multiple Splunk Cloud Platform deployments.
Ad-hoc search Yes Yes
Scheduled search No Yes
Workload management (WLM) No Yes
Search processing language (SPL) coverage No special syntax required. All commands allowed. No special syntax required. All commands allowed, but some commands have restricted function. For example, you cannot use from to reference remote saved search datasets.
Security (RBAC) Hybrid search enforces all security at the Splunk Enterprise search head. Transparent mode federated searches enforce all security at the Splunk Enterprise search head. There is no need to configure additional security on the indexer tier. See Service accounts and federated search security.
Search Head architecture For hybrid search, the Splunk Cloud Platform requires a single search head. Hybrid search does not let you search Splunk Cloud Platform environments with search head cluster configurations. Federated search works with all search management tier architecture options and combinations.
Version compatibility and upgrades There are strict version dependencies for hybrid search between Splunk Enterprise and Splunk Cloud Platform environments. An upgrade on either side can break hybrid searches until you upgrade the corresponding deployment to a compatible version. For transparent mode federated search, you need to have Splunk Enterprise 9.0 or higher and Splunk Cloud Platform 8.2.2107 or higher. There isn't a strict versioning dependency between the two platforms. Splunk Cloud Platform upgrades do not break federated searches.
Operability To enable and configure hybrid search between a Splunk Enterprise environment and Splunk Cloud Platform environment, you must contact your Splunk representative. To enable federated search with a remote Splunk Cloud Platform deployment, you must contact your Splunk representative to open management port 8089 on the deployment and configure IP allow lists for its search heads.

Transparent or standard mode?

Federated search offers two modes of operation: standard and transparent. These modes provide two different experiences of federated search.

Transparent mode gives hybrid search users a smooth transition to federated search. Transparent mode requires the least amount of change to existing saved searches and search workflow.

For an overview of federated search terminology and a comparison of the two federated search modes, see About federated search.

Move to federated search

To move to federated search, you must first contact Splunk Support to get your Splunk Cloud Platform deployment configured for federated search. Then you follow a few self-service setup steps. Afterwards, you can run federated searches that combine data from your local Splunk Enterprise deployment and a remote Splunk Cloud Platform deployment.

  1. Contact Splunk Support to configure the Splunk Cloud Platform Deployment for federated search.
  2. Create a service account for the Splunk Cloud Platform deployment.
  3. Disable hybrid search on your Splunk Enterprise deployment.
  4. Create a federated provider definition for the Splunk Cloud Platform deployment.
  5. Write and run federated searches.

Contact Splunk Support to configure the Splunk Cloud Platform deployment for federated search

To run federated searches, Splunk Cloud Platform deployments require additional configuration from Splunk Support. If you have a support contract, file a new case using the Splunk Support Portal at Support and Services. Otherwise, contact Splunk Customer Support.

Create a service account for the Splunk Cloud Platform deployment

A service account is a dedicated user account that you create on the remote Splunk Cloud Platform deployment over which you want to run federated searches. The service account allows users on the local Splunk Enterprise deployment to apply their own data access privileges and permissions to the searches they run over the remote deployment. The service account must have a role with the fsh_manage capability.

See Service accounts and federated search security.

Disable hybrid search on your Splunk Enterprise deployment

Disable hybrid search on your local Splunk Enterprise deployment before you set up federated provider definitions on that deployment.

For instructions see Disable hybrid search in the Splunk Cloud Platform Admin Manual.

If you skip this step, you risk getting duplicated or incomplete search results during the period when hybrid search and transparent mode federated search are simultaneously operating on your system.

Create a federated provider definition for the Splunk Cloud Platform deployment

You create a federated provider definition for your Splunk Cloud Platform deployment through the Federated Provider page. The Federated Provider page is available in Settings. These settings determine how the federated search head on your Splunk Enterprise deployment collaborates with the remote search heads on your federated provider to run a federated search.

See Define a federated provider.

An image of the Add Federated Provider dialog, filled out for a federated provider named provider001.

When you set up a Splunk Cloud Platform environment as a federated provider, you:

Determine whether the provider uses standard mode or transparent mode
If you are transitioning from hybrid search to federated search, use transparent mode.
Help your local federated search head connect to the remote federated provider
Supply the Splunk Cloud Platform environment host name and management port number (8089).
Provide the service account credentials
Supply the service account user id and password you defined previously.

Now you are ready to run federated searches.

Write and run federated searches

Under transparent mode you can run the same kinds of searches that you used for hybrid search, without changes to syntax.

See Run federated searches for more information about writing federated searches and about restrictions on federated searches.

Last modified on 05 August, 2022
PREVIOUS
About federated search
  NEXT
Service accounts and federated search security

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters