Splunk Cloud User Manual

Configure hybrid search

To examine data in Splunk Enterprise and Splunk Cloud in a single search, you can configure an on-premises Splunk Enterprise search head to connect to a Splunk Cloud indexer cluster. This configuration is called hybrid search.

The following conditions and limitations apply to hybrid search.

• You can initiate searches from an on-premises Splunk Enterprise search head to a Splunk Cloud deployment.
• You cannot initiate searches from a Splunk Cloud search head to an on-premises Splunk Enterprise deployment.
• The version of the on-premises Splunk Enterprise search head must be equal to or higher than the version of Splunk Cloud.
• Ad-hoc search is supported.
• Scheduled searches are not supported.
• Hybrid search is not available for use with any Splunk premium solutions such as Enterprise Security and IT Service Intelligence.

To enable hybrid search

1. Go to the Support portal and open a case with Splunk Support, requesting them to enable hybrid search for your Splunk Cloud instance. Be sure to specify that you want a 1 MB Splunk Enterprise license for the on-premises search head that you want to use for hybrid search. Splunk Support sends you the license and the Master URI and security key for your Splunk Cloud deployment, which are required to configure hybrid search.
2. Log into your Splunk Enterprise search head.
3. In Splunk Web, select Settings > Distributed Environment > Indexer Clustering.
4. Click Enable indexer Clustering.
5. Select Search head node and click Next.
6. Enter the Master URI and security key that you received from Splunk Support.
7. Click Enable search head node.
8. Open the Server Controls page and restart the search head.
9. Run a search command like the following, which retrieves Splunk log events and lists the servers that the events come from:
   index = _* | stats count by splunk_server.

If hybrid search is configured correctly, results from both your Splunk Enterprise and your Splunk Cloud deployments are listed.