https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218074#M42883 <P>In addition to woodcock's excellent answer, you can also refer to the Splunk Light documentation topic <A href="http://docs.splunk.com/Documentation/SplunkLight/6.4.1/GettingStarted/GettingdataintoSplunkLightusingLinux">Getting data into Splunk Light using Linux</A> </P> Thu, 23 Jun 2016 15:04:09 GMT andrewb_splunk 2016-06-23T15:04:09Z https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218070#M42879 <P>We have splunk-light 1GB per day license. We expect about 400 MB of events on a normal day. I'd like to set up one splunk instance then multiple instances of universal forwarder (UF) on a few other linux servers. </P> <P>How do I, and do I need to, configure splunk as a search head, indexer and deployment server for UF to be able to transmit events to splunk and then search the same server instance.</P> Thu, 23 Jun 2016 14:17:01 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218070#M42879 daddyoh 2016-06-23T14:17:01Z https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218071#M42880 <P>All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.</P> <P>See here for DS:<BR /> <A href="https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066">https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066</A></P> <P>The basic steps are:</P> <PRE><CODE>1: Stand Up a new Search Head to use as DS. 2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/ 3: Create a serverclass.conf file on the DS (put your forwarder and app details in there). 4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there. </CODE></PRE> Thu, 23 Jun 2016 14:35:17 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218071#M42880 woodcock 2016-06-23T14:35:17Z https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218072#M42881 <P>Thanks. How can I make it a deployment server so that I can test it and see if it can handle the volume. I am limited on hardware availability right now.</P> Thu, 23 Jun 2016 14:38:15 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218072#M42881 daddyoh 2016-06-23T14:38:15Z https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218073#M42882 <P>Answer updated.</P> Thu, 23 Jun 2016 14:41:33 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218073#M42882 woodcock 2016-06-23T14:41:33Z https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218074#M42883 <P>In addition to woodcock's excellent answer, you can also refer to the Splunk Light documentation topic <A href="http://docs.splunk.com/Documentation/SplunkLight/6.4.1/GettingStarted/GettingdataintoSplunkLightusingLinux">Getting data into Splunk Light using Linux</A> </P> Thu, 23 Jun 2016 15:04:09 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218074#M42883 andrewb_splunk 2016-06-23T15:04:09Z https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218075#M42884 <P>Woodcock - Your 4 steps did the trick. That was what was what I needed to fill in the gaps in the volumes of documentation from splunk. We have a qa server now forwarding 3 log files. I expect to get our production servers forwarding this week. </P> <P>Thank You very much.</P> Sat, 09 Jul 2016 10:43:00 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-install-single-splunk-instance-on-linux/m-p/218075#M42884 daddyoh 2016-07-09T10:43:00Z