https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277534#M53222 <P>I would suggest some homework first. Have a look at the Distributed Deployment guide, perhaps starting here: <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Deploy/Implementationoverview">http://docs.splunk.com/Documentation/Splunk/6.5.2/Deploy/Implementationoverview</A></P> <P>This configuration is a highly common, typical small Splunk configuration. You:</P> <OL> <LI>Disable the web interface on the indexer</LI> <LI>Configure the search head to act as a search peer of the indexer</LI> <LI>Configure the search head to forward its _internal and other local logs to your indexer</LI> </OL> <P>This design is well-covered in the Distributed Deployment guide linked above as well as in the Splunk System Administration class. If you have specific questions about deploying this design, I would suggest a more specific follow-up question (or questions).</P> Sun, 05 Feb 2017 16:09:05 GMT dwaddle 2017-02-05T16:09:05Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277533#M53221 <P>I have 3 systems, I want one system to work as Forwarder, one as Indexer and one as Search Head.<BR /> Setting up forwarder is fine, but to separate indexing and searching.<BR /> Means on the indexing system searching should not be available and on search system indexing should not be available.<BR /> How can I achieve this type of configuration?</P> <P>Please let me know if you want more details.</P> Sun, 05 Feb 2017 13:37:43 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277533#M53221 gaurav_maniar 2017-02-05T13:37:43Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277534#M53222 <P>I would suggest some homework first. Have a look at the Distributed Deployment guide, perhaps starting here: <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Deploy/Implementationoverview">http://docs.splunk.com/Documentation/Splunk/6.5.2/Deploy/Implementationoverview</A></P> <P>This configuration is a highly common, typical small Splunk configuration. You:</P> <OL> <LI>Disable the web interface on the indexer</LI> <LI>Configure the search head to act as a search peer of the indexer</LI> <LI>Configure the search head to forward its _internal and other local logs to your indexer</LI> </OL> <P>This design is well-covered in the Distributed Deployment guide linked above as well as in the Splunk System Administration class. If you have specific questions about deploying this design, I would suggest a more specific follow-up question (or questions).</P> Sun, 05 Feb 2017 16:09:05 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277534#M53222 dwaddle 2017-02-05T16:09:05Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277535#M53223 <P>hey @dwaddle thanks for the help. Actually I just completed power user certification and about to start with administration. Just one more query, after setting up the environment as you have mentioned if I link more forwarders to indexer I have to not worry about search head ???</P> Sun, 05 Feb 2017 17:32:45 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277535#M53223 gaurav_maniar 2017-02-05T17:32:45Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277536#M53224 <P>correct. Search heads don't particularly care about how many forwarders are connected to the indexer. But, if you are going to add a bunch of forwarders, then you should be looking at adding a deployment server to your design.</P> Sun, 05 Feb 2017 21:39:44 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277536#M53224 dwaddle 2017-02-05T21:39:44Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277537#M53225 <P>Thanks Bro <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 06 Feb 2017 04:44:59 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277537#M53225 gaurav_maniar 2017-02-06T04:44:59Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277538#M53226 <P>we should install forwarder on search head?</P> Sat, 09 May 2020 14:26:42 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/277538#M53226 nasimm 2020-05-09T14:26:42Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/526834#M88864 <P>Does the search head and indexer must be deployed on different separate servers with different ip adresses? And doest it mean that i have to install splunk on those different servers?</P><P>What's the problem with having the indexer and searchhead deployed on 1 server?</P><P>&nbsp;</P> Wed, 28 Oct 2020 11:13:56 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Configuration-for-Search-Head-Indexer-and-Fowarder/m-p/526834#M88864 Simons20 2020-10-28T11:13:56Z