topic Re: setup splunk/forwader in the same platform in Getting Data In

setup splunk/forwader in the same platform

smith_ — Mon, 12 Aug 2024 10:28:01 GMT

Hi,

I want to setup a home lab like splunk Enterprise and splunk forwarder on the same os to pull the logs into splunk. Is it possible to setup in this way.

Re: setup splunk/forwader in the same platform

gcusello — Mon, 12 Aug 2024 10:44:07 GMT

Hi @smith_ ,

yes, it's possible, but you should define the purpose, the borders and the Use Cases of your lab.

In other words: what architecture you need to test: a distributed environment? only forwarder and Indexer? what else?

In my lab I have seved virtual machines with

two Indexers,
three Search Heads,
a Management Node (Cluster Manager, Deployer, License Master, Monitoring Console and Deployment Server),
one Universal Forwarder.

I did it on pc pc that hase 16 vCPUs and 32 GB TAM).

As I said, you can do this, it depends on your requirements and the resources you have.

Ciao.

Giuseppe

Re: setup splunk/forwader in the same platform

smith_ — Mon, 12 Aug 2024 12:04:04 GMT

@gcusello ,
I am looking for only forwarder and Indexer.

Re: setup splunk/forwader in the same platform

gcusello — Mon, 12 Aug 2024 15:29:27 GMT

Hi @smith_ ,

in this case, you have to configure two virtual machines that are connected:

one with Splunk Enterprise and one with Splunk Universal Forwarder.

Ciao.

Giuseppe

Re: setup splunk/forwader in the same platform

isoutamo — Mon, 12 Aug 2024 15:46:53 GMT

the easiest way is use separate virtual machines, but you could do it also e.g. on linux box on lab env. In production this is not proposed way to do it.

In linux you can just install 1st indexers and start it. Then you could install UF and start it with different ports for mgmt and probably some other. You just must check correct parameters from docs (I cannot find those now). But if I recall right UF tell that normal ports are reserved and ask to use some other ports.

r. Ismo