About federated search

You can run federated searches to search datasets outside of your local Splunk deployment. From your local search head, federated search gives you a holistic view of datasets across multiple Splunk platform deployments.

Federated search is topology-agnostic, so it works despite the complexity of the Splunk platform deployments involved. You can run a federated search across any remote Splunk Cloud Platform or Splunk Enterprise deployment.

Federated search is currently unavailable for regulated (FedRAMP, PCI, and HIPAA) Splunk Cloud Platform environments.

Do you use hybrid search? See Migrate from hybrid search to federated search.

Components of a typical federated search setup

Federated search introduces a set of terms. Familiarize yourself with them before you attempt to dig into setting up and running federated searches.

Federated search

A search of one or more remote datasets on one or more federated providers.

Local deployment

The Splunk platform deployment from which you run federated searches. The federated search head for your federated search resides on your local deployment.

In this context, "local" does not refer to your physical location. If you are in London and are logging into a Splunk platform deployment located in New York City when you run a federated search, that New York City deployment is the local deployment for your federated search.

Federated search head

A search head residing on your local deployment that initiates federated searches.

Federated provider

A remote Splunk platform deployment. Contains the data that you search with your federated searches.

Before you can run federated searches, you must create federated provider definitions on the local Splunk platform deployment. A federated provider definition serves several purposes:

• It enables the federated search head to make network connections to the federated provider and run searches on a remote search head on that provider through a service account.
• It determines whether the federated provider runs in standard or transparent mode.
• It determines which set of knowledge objects the federated provider applies to federated searches.

See Define a federated provider.

Remote search head

A search head on a federated provider.

Federated index

An index you create on your federated search head to run federated searches over standard mode federated providers. Each federated index maps to a specific remote dataset on a standard mode federated provider. Federated indexes do not ingest data or events. They provide a logical mapping to remote datasets. See Create a federated index.

Remote dataset

A dataset on a standard mode federated provider. Currently, only events indexes and saved searches qualify as remote datasets.

How federated search works

The federated search process works similarly to distributed search. On a distributed search, the initial processing of a search is handled by the indexers of a Splunk platform deployment, and then the results are aggregated on the search head for that deployment to produce a final result set.

Federated searches, however, are broken up into parts that are processed on a "local" Splunk platform deployment and parts that are processed on one or more remote Splunk platform deployments. Each of these remote Splunk platform deployments is a federated provider.

For example, say you have a simple federated search that involves only one federated provider. In this case, the federated search process sends the remote portion of the search to the federated provider. On the federated provider, the remote search head and its indexers process the search independently. The remote search head then sends the results back to the federated search head on the local Splunk platform deployment, where the local search head aggregates the remote results into the final result set for the complete federated search.

The following diagram illustrates a federated search over a remote Splunk platform deployment. The remote deployment is a standard mode federated provider. The federated provider has an events index dataset that is available for federated searches. On the local Splunk platform deployment, a federated index on the federated search head maps to a remote dataset.

The federated index in this example is there because the federated provider in this example is a standard mode federated provider. Transparent mode federated providers do not require federated indexes.

A simple federated search for this setup might look like this:

index=federated:provider1_fedindex1 | stats count

This search references a federated index named provider1_fedindex1. The provider1_fedindex1 federated index maps to the remote dataset stored on Federated Provider 1. The remote search head uses this mapping to send back events from its remote index dataset to the federated search head on your local deployment. The federated search head runs the stats count operation on those events. When this stats count aggregation is complete, the federated search head presents the results without additional processing, as there are no additional datasets involved in the search.

See Run federated searches to learn how to write federated searches.

Kinds of federated searches you can set up

This table lists the three kinds of federated searches that you can set up, and the Splunk Enterprise or Splunk Cloud Platform versions that those types of federated searches require.

Kind of federated search	Local Splunk platform deployment	Remote Splunk platform deployment
Splunk Enterprise to Splunk Enterprise	Splunk Enterprise (version 8.2.0 or higher)	Splunk Enterprise (version 8.2.0 or higher)
Splunk Cloud Platform to Splunk Cloud Platform	Splunk Cloud Platform (version 8.1.2103 or higher)	Splunk Cloud Platform (version 8.2.2104 or higher)
Splunk Enterprise to Splunk Cloud Platform	Splunk Enterprise (version 8.2.0 or higher)	Splunk Cloud Platform (version 8.2.2104 or higher)

If your local deployment is on Splunk Cloud Platform, you can run federated searches over other Splunk Cloud Platform deployments. If your local deployment is on Splunk Enterprise, you can run federated searches over remote Splunk Cloud Platform deployments and remote Splunk Enterprise deployments.

If you have a Splunk Enterprise deployment that is lower than 8.2 and want to run federated searches without upgrading the entire deployment, you can upgrade a single search head in that deployment to 8.2 and run federated searches from that search head.

About standard and transparent mode

When you define a federated provider, you must decide what mode you want that provider to use. Federated provider modes offer different federated search experiences, and you must select the mode that best fits your needs.

You have two federated provider mode options: standard and transparent.

• Choose standard mode if you want to restrict access to remote indexes and remote dataset types that you can invoke with the from command, such as saved search datasets. Standard mode is the best fit for federated search users who are not migrating from a hybrid search setup.
• Choose transparent mode if you use hybrid search and want to migrate to federated search. Transparent mode lets you run your hybrid mode searches without syntax changes.

Transparent mode is available in Splunk Cloud Platform 8.2.2107. The following table describes the differences between the two modes.

Category	Standard mode federated search	Transparent mode federated search
Kinds of federated search	Applies to the following kinds of federated search: Splunk Cloud Platform to Splunk Cloud Platform Splunk Enterprise to Splunk Enterprise Splunk Enterprise to Splunk Cloud Platform, if you are not migrating to federated search from a hybrid search setup.	Applies to Splunk Enterprise to Splunk Cloud Platform federated search, if you are migrating from a hybrid search setup.
Provider setup	Requires: A federated provider definition. A separate federated index definition for each dataset on the federated provider that you want to search. You can designate events indexes and saved searches as searchable datasets. You can associate a single remote deployment with multiple standard mode federated provider definitions. For example, for one remote deployment you might set up different standard mode federated provider definitions for different application contexts.	Requires federated provider definition only. You can associate a single remote deployment with only one transparent mode federated provider definition.
Knowledge objects applied to searches	Can use either of these options: Remote knowledge objects from the federated provider. This is the best practice for standard mode federated providers. Local knowledge objects from the federated search head.	Must use local knowledge objects from the federated search head.
Security	When Local Knowledge Objects is enabled, access to data on the remote federated provider is determined by role-based security settings for the user running the federated search from the local federated search head. The service account you define on the remote search head must have a role with the fsh_manage capability. When Local Knowledge Objects is disabled, access to data on the federated provider is determined by role-based settings on the federated provider service account. You can additionally give your users selective role-based access to federated indexes, which restricts the datasets they can search on the federated provider.	Access to data on the remote federated provider is determined by role-based security settings for the user running the federated search from the local federated search head. The service account you define on the remote search head must have a role with the fsh_manage capability.
Which searches run as federated searches on the federated provider	Only those searches that invoke federated indexes run over remote datasets on federated providers. Searches that do not invoke federated indexes run only on your local Splunk platform deployment.	When you connect your local instance to a transparent mode federated provider, all of your searches run over that federated provider as federated searches, whether or not you intend for them to search remote datasets on that provider. This might reduce the performance of some of your searches.
Special search processing language (SPL) syntax required?	Yes	No
SPL limitations	Standard mode searches cannot include: Generating commands other than search and from. Metrics commands such as mpreview or mstats. The tstats or datamodel commands. Lookups. When running federated searches over standard mode federated providers, you cannot use wildcards to reference multiple federated indexes.	Transparent mode searches cannot use from to reference saved search datasets.
Dataset availability	You can search events index and saved search datasets on a federated provider.	You can search events and metrics indexes on a federated provider.

About federated search and Splunk security and IT products

Federated search supports Splunk IT Service Intelligence version 4.16.0 and higher, for transparent mode federated search only. For more information, see New features in Splunk IT Service Intelligence in the ITSI 4.16.0 Release Notes.

Set up federated search between Splunk platform deployments

Complete the following steps to set up federated search between a local Splunk platform deployment and a remote Splunk platform deployment.

To run federated searches, Splunk Cloud Platform deployments require additional configuration from Splunk Support. This is true whether the Splunk Cloud Platform deployment is on the local or remote side of the federated search. If you are setting up federated search between two Splunk Cloud Platform deployments, you must contact Splunk Support for both deployments.

If you have a support contract, file a new case using the Splunk Support Portal at Support and Services. Otherwise, contact Customer Support.

1. Set up a service account on the remote Splunk platform deployment that you will set up as a federated provider. See Service accounts and federated search security.
2. Apply a federated provider definition to the remote Splunk platform deployment. Determine whether the federated provider runs in standard or transparent mode. See Define a federated provider.
3. Create one or more federated index definitions. Required only for standard mode federated providers. See Create a federated index.
4. Learn how to construct and run a federated search. Standard mode federated searches use a special search syntax. Both modes have certain limitations. See Run federated searches.