set_enterprise_search_options

Use this command to specify which data is included in the investigation dashboard: data from all managed units in a centrally managed system, or an individual Guardium system. By default, a collector dashboard shows data from that collector, and the Central Manager dashboard shows data of the entire cluster.

This API is available in Guardium V9.5 and later.

GuardAPI syntax

set_enterprise_search_options parameter=value

Parameters

Parameter Value type Description

Parameter	Value type	Description
distributed_search	String	Required. Controls the sources of data that is displayed in the investigation dashboard. Valid values: `cm_only`: Use this option on a central manager to retrieve data from all managed units in the centrally managed environment that have enable_quick_search=1. (If you enter `cm_only` on a managed unit, only data from that managed unit is displayed.) `all_machines`: Use this option on a managed unit in a centrally managed environment to include data from all units in the environment. `all_machines` mode requires open network access on port 8983 between all nodes, which might not comply with your security policies. Data retrieval might be slower than on the central manager. Default = cm_only
api_target_host	String	Specifies the target hosts where the API executes. Valid values: `all_managed`: execute on all managed units but not the central manager `all`: execute on all managed units and the central manager `group:<group name>`: execute on all managed units identified by `<group name>` host name or IP address of a managed unit: specified from the central manager to execute on a managed unit. For example, `api_target_host=10.0.1.123`. host name or IP address of the central manager: specified from a managed unit to execute on the central manager. For example, `api_target_host=10.0.1.123`. IP addresses must conform to the IP mode of your network. For dual IP mode, use the same IP protocol with which the managed unit is registered with the central manager. For example, if the registration uses IPv6, specify an IPv6 address. The hostname is independent of IP mode and can be used with any mode.

distributed_search

String

Required. Controls the sources of data that is displayed in the investigation dashboard. Valid values:

cm_only: Use this option on a central manager to retrieve data from all managed units in the centrally managed environment that have enable_quick_search=1. (If you enter cm_only on a managed unit, only data from that managed unit is displayed.)
all_machines: Use this option on a managed unit in a centrally managed environment to include data from all units in the environment. all_machines mode requires open network access on port 8983 between all nodes, which might not comply with your security policies. Data retrieval might be slower than on the central manager.

Default = cm_only

api_target_host

String

Specifies the target hosts where the API executes. Valid values:

all_managed: execute on all managed units but not the central manager
all: execute on all managed units and the central manager
group:<group name>: execute on all managed units identified by <group name>
host name or IP address of a managed unit: specified from the central manager to execute on a managed unit. For example, api_target_host=10.0.1.123.
host name or IP address of the central manager: specified from a managed unit to execute on the central manager. For example, api_target_host=10.0.1.123.

IP addresses must conform to the IP mode of your network. For dual IP mode, use the same IP protocol with which the managed unit is registered with the central manager. For example, if the registration uses IPv6, specify an IPv6 address. The hostname is independent of IP mode and can be used with any mode.

Examples

To configure the investigation dashboard to search data across the entire Guardium environment, from any Guardium system in that environment:

grdapi set_enterprise_search_options distributed_search=all_machines