I am looking to revamp our Splunk test environment and build a new one from scratch that better suits our needs. Our production environment consists of both a search head cluster and an indexer cluster along with all of the other various Splunk components. I would love to replicate our clusters on a smaller scale to ensure our test environment pretty closely mirrors production. It appears though that the Dev/Test License doesn't support clustering. Does anyone have any recommendations on how to best go about it? I can setup standalone instances with no problem, just curious how other's have addressed this as newer versions of Splunk sometimes make changes to clustering services and I want to ensure they are close to 100% tested before production upgrades.
Also whats the best way to get test data into the test environment? Is the best route to just forward some data from production? Is there a way to mask the data or a way to create dummy data?
Thanks in advance!