topic Re: Splunk free - setting up a distributed environement (Search Head, 1 IDX, 1 UF, maybe a deployment server) in Deployment Architecture

Splunk free - setting up a distributed environement (Search Head, 1 IDX, 1 UF, maybe a deployment server)

spluzer — Fri, 07 May 2021 17:06:21 GMT

Hey Splunksters,

My work environment is switching from Windows (large distributed enviro) to Linux pretty soon.

I'd like to get familiar with architecting in Linux so I had a couple of questions:

I'm wondering if I can simply spin up 3-5 aws linux vm's and use the free version of splunk to get familiar with the process of creating a distributed enviro (assigning a search head, 1 idx, maybe couple of forwarders and a deployment server using the free splunk???

Or, is the free splunk Enterprise only good for 1 download on 1 machine ??

Thanks!

Re: Splunk free - setting up a distributed environement (Search Head, 1 IDX, 1 UF, maybe a deployment server)

ragedsparrow — Fri, 07 May 2021 17:08:35 GMT

Greetings,

Splunk Free is only available for a single, stand-alone instance. You will be unable to build a distributed environment with a Splunk Free license.

Re: Splunk free - setting up a distributed environement (Search Head, 1 IDX, 1 UF, maybe a deployment server)

harsmarvania57 — Fri, 07 May 2021 17:09:10 GMT

Hi,

Yes you can setup multiple VMs for different Splunk role with Splunk Entrprise (which has 500MB license for 60 days).

Re: Splunk free - setting up a distributed environement (Search Head, 1 IDX, 1 UF, maybe a deployment server)

ragedsparrow — Fri, 07 May 2021 17:19:08 GMT

However, as previously mentioned, you could use the Splunk Enterprise Trial license to do what you're wanting.

Re: Splunk free - setting up a distributed environement (Search Head, 1 IDX, 1 UF, maybe a deployment server)

isoutamo — Fri, 07 May 2021 21:35:01 GMT

But you cannot use separate LM. Use local trial licenses in all nodes.