Seems like a relatively simple issue but I'm stumped.
I've got peers setup on on a search head.. and if I do a search referencing an index ONLY available on the remote peer.. it will only work if I do it as follows.
index=INDEX_NAME splunk_server=*
if I don't invoke splunk_server= no results are returned.
Further, when in access control none of the indexes are shown from the peer.
By default only the main index is searched. I did try setting default searched indexes to all non_internal but that didn't work either unless i invoked splunk_server.
What am I missing?
↧