Federated Search isn’t only a query-time feature. Its usefulness depends on decisions made earlier: table layout, catalog metadata, permissions, and the questions analysts need to answer.

Historical firewall telemetry is valuable during an investigation; even after it has moved out of hot storage. This pattern keeps Cisco Firewall data in Amazon S3 while making it searchable from Splunk Cloud Platform through Federated Search.

First post here. I’m a Technical Marketing Engineer focused on Cisco Data Fabric, Federated Search, and practical machine data management. I’ll share field notes, architecture takeaways, and lessons for Splunk enthusiasts building cleaner, more useful data paths. #Splunk #Cisco