https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-Heavy-Forwarder-and-Splunk-Searchhead-on/m-p/407613#M72269 <P>Hi sarvesh_11,</P> <P>I can see Two ways:<BR /> 1 - transform your UF in HF<BR /> 2 - install splunk enterprise on the "SH" server, then configure inputs. conf, outputs.conf and TA if necessary as you should do it on the HF.</P> <P>A single instance can have multiple roles.</P> <P>Cheers.</P> <P>Olivier.</P> Fri, 26 Jul 2019 06:57:48 GMT o_calmels 2019-07-26T06:57:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-Heavy-Forwarder-and-Splunk-Searchhead-on/m-p/407612#M72268 <P>Hi @gcusello (tagging u because i have seen many of your answers in this context <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> ) ,<BR /> Is it possible to configure Splunk Heavy Forwarder and Search head on the same machine?<BR /> As our indexer is on Splunk Cloud, for the data formatting, to work on props.conf we need a heavy forwarder in between UF and Indexer. Also, i am restricted for the count of machine i can engage.<BR /> What i am left with is, to configure HF and SH on same machine.</P> <P>TIA</P> Fri, 26 Jul 2019 06:46:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-Heavy-Forwarder-and-Splunk-Searchhead-on/m-p/407612#M72268 sarvesh_11 2019-07-26T06:46:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-Heavy-Forwarder-and-Splunk-Searchhead-on/m-p/407613#M72269 <P>Hi sarvesh_11,</P> <P>I can see Two ways:<BR /> 1 - transform your UF in HF<BR /> 2 - install splunk enterprise on the "SH" server, then configure inputs. conf, outputs.conf and TA if necessary as you should do it on the HF.</P> <P>A single instance can have multiple roles.</P> <P>Cheers.</P> <P>Olivier.</P> Fri, 26 Jul 2019 06:57:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-Heavy-Forwarder-and-Splunk-Searchhead-on/m-p/407613#M72269 o_calmels 2019-07-26T06:57:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-Heavy-Forwarder-and-Splunk-Searchhead-on/m-p/407614#M72270 <P>Hi sarvesh_11,<BR /> Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!<BR /> Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.<BR /> So you can use a server for both your roles.</P> <P>The question is: why to do this? <BR /> In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.<BR /> The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.<BR /> In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.</P> <P>Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).</P> <P>Bye.<BR /> Giuseppe</P> Fri, 26 Jul 2019 07:29:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-Heavy-Forwarder-and-Splunk-Searchhead-on/m-p/407614#M72270 gcusello 2019-07-26T07:29:32Z