topic Splunk Lab - Minimum servers in #Random

Splunk Lab - Minimum servers

Esky73 — Tue, 14 Feb 2017 00:51:22 GMT

Hi,

Creating a Splunk lab to play around with configurations etc ..

Will the following suffice - any gotchyas (ports etc) or can they all share the mgmt port on the deployer box :

2 x SH
2 x IDX
1 x Deployer consisting of - Deployer, deployment server, CM, LM (can they all co-exist)
2 x UF's

Cheers.

Re: Splunk Lab - Minimum servers

esix_splunk — Tue, 14 Feb 2017 00:57:40 GMT

In a lab, this should be more then sufficient.

However, for a SHC (search head cluster,) you need to have a minimum of 3 servers for the SHC to function properly. That being said, you can force a captain with two members, but its a manual process as described in the docs on : http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/SHCarchitecture

On a side note, in a production environment, you would want to separate the roles of these servers. Typically the CM and LM and coexist on lower spec machines (perfect for virtualization). The deployer and DS can also co-exist, however, depending upon the number of clients, having a dedicated DS is typically recommended.

Cheers
Eric

Re: Splunk Lab - Minimum servers

Esky73 — Tue, 14 Feb 2017 01:19:37 GMT

Cheers Eric .. yep aware of the prod requirements - thanks for the SHC tip.

Re: Splunk Lab - Minimum servers

Lucas_K — Tue, 14 Feb 2017 08:28:44 GMT

All those will need their own ports as they will complain about it during start up. Splunkweb, splunkd, app port,kvstore ports should all be unique.

Also create individual host names in server.conf and inputs.conf. This servers two purposes.

You can tell what is going on when you check internals.
Distsearch requires unique names to work (it's used for the public key storing directory name).

Also perhaps throw in a heavy forwarder so you can try out advanced routing techniques.

Re: Splunk Lab - Minimum servers

Esky73 — Tue, 14 Feb 2017 22:56:15 GMT

Thanks Lucas,

For Clarification :

If i don't need 2 x SH at this stage - and therefore no deployer.
If a deployer was required then i'd have to install splunk in a new location if i was using the same box eg /opt/splunk_shc and i would need to change the ports ?

So the LM, CM and deployment server can all co-exist on the one box with no port adjustments - they can all use the mgmt port 8089 ?

Re: Splunk Lab - Minimum servers

nickhills — Wed, 15 Feb 2017 07:01:44 GMT

Yes, LM and CM are just "features" of the main Splunk Enterprise install and simply need to be "enabled" - (as are DM and Deployer too for that matter)

You will therefore only need one splunk install for all 4 of these services to work (albeit not best practice)