Enable Federated Search for Splunk Cloud to Splunk Cloud Platform

Applicability

Description

A request may be opened to enable Federated Search between two Splunk Cloud Platform stacks, for example:

stack01.splunkcloud.com  ->  stack02.splunkcloud.com

In this scenario, stack01 is the Federated Search Head, or source stack, and stack02 is the remote Splunk Cloud stack being searched. Federated Search requires connectivity between the stacks on the Splunk management/API endpoint, typically port 8089.

For the connection to work, the required public IP addresses or CIDR ranges must be allow listed in the correct access rules for both Splunk Cloud stacks.

Investigation

Review the relevant Splunk documentation:

• Introducing Splunk Federated Search
• Define a federated provider
• Configure IP allow lists for Splunk Cloud Platform

For Splunk Cloud to Splunk Cloud Federated Search, Splunk Support must submit the required internal request to update the stack access rules.

The changes need to be confirmed due it is going to use stack01" (FSH) and "stack02" (RSH):
Steps to be considered:
a. Open "stack01" (FSH) stack spec file - and allowlist "public IP" of stack "stack02" (RSH) inside "Federated Search Egress" under "Access Rules."
b. Open "stack02" (RSH) stack spec file - and allowlist "public IP" of stack "stack01" (FSH) inside "API Allow List" under "Access Rules."

Resolution

Open a Splunk Support case requesting Federated Search enablement between the two Splunk Cloud Platform stacks.

Include the following details in the case:

• Source stack name and URL
• Remote stack name and URL
• Confirmation that this is a Splunk Cloud to Splunk Cloud Federated Search request 

Related Links

Introducing Splunk Federated Search
Define a federated provider
Configure IP allow lists for Splunk Cloud Platform