Splunk Distrubuted Deployment in my Local System

rakshithreddy — Sun, 22 Oct 2017 07:46:10 GMT

Hi all,

I am trying to set up a small Splunk distributed deployment in my Local System.
with
3 Indexers
Master
1 Search Head
License Master ( Enterprise Trial 60 days License )

When I was trying to add the slaves to License Master, Its keep on getting this error -

Bad Request — In handler 'localslave': editTracker failed, reason='Unable to connect to license master:

Question:
Can I create a Distributed Setup using Enterprise Trial License?
can I request Splunk support for Trial License which can work with this setup?

Thank you

Re: Splunk Distrubuted Deployment in my Local System

koshyk — Sun, 22 Oct 2017 09:06:26 GMT

I think, you are hitting some basic issues. So my suggestion is you to learn a bit more into making settings correctly and read the configs to setup a larger cluster system. Please find suggestions in order of preference
1. Get a developer license (10GB per day) with full license options. Its free.
2. Setup a standalone System with SH, IDX all in same machine with license . Check everything is working
3. Now create 4 indexers separately and use a Cluster Master
4. Now split license server outside and so on..
5. Finally make a SH cluster

If you don't want to have all the pain, Use docker. Best docker images are
1. Full blown Splunk-n-box => https://github.com/mhassan2/splunk-n-box
2. Simpler Docker Splunk => https://github.com/getkub/docker_splunk

You can then customise the docker setup to bring up all the cluster etc, rather than having individual installations in VM

topic Splunk Distrubuted Deployment in my Local System in Deployment Architecture

Splunk Distrubuted Deployment in my Local System

Re: Splunk Distrubuted Deployment in my Local System