federated index

federated index

noun

An index you create on a federated search head for the purpose of running federated searches. Each federated index maps to a specific remote dataset on a federated provider. In Federated Search for Splunk, federated indexes can map to indexes, saved searches, and data models. Federated indexes for Federated Search for Amazon S3 map to AWS Glue Data Catalog tables. Federated indexes can't be targets for data inputs.

When you write a federated search you invoke federated indexes by name to indicate that you wish to search the datasets to which the indexes map.

Federated indexes are governed by federated index definitions, which you create and manage in Splunk Web.

For more information

In the Search Manual:

• About Federated Search for Splunk
• Map a federated search to a remote Splunk dataset
• Map a federated index to an AWS Glue Data Catalog table dataset