Deployment Architecture

Can multiple instances be installed under the same path?

MKroki
Explorer

Hi,
Is it possible to have multiple instances under the same path.
Splunk 6.3.1.
One machine (linux)

For example:

/opt/splunk - indexer
/opt/splunk/splunksh - search head
/opt/splunk/splunkforwarder - forwarder

Thanks

Tags (1)
0 Karma
1 Solution

dgrubb_splunk
Splunk Employee
Splunk Employee

Yes you can, really good for building a simple dev environment. But although you can I wouldn't do that for production systems.

View solution in original post

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

Yes you can, really good for building a simple dev environment. But although you can I wouldn't do that for production systems.

0 Karma

MKroki
Explorer

Thanks for answer. I have same thoughts.
I'm wondering, will be problems with upgrading in future if (in same example) indexer is installed with rpm package and other two with tgz package. Will rpm run over search head instance and forwarder instance, because rpm default installation path is /opt/splunk/

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

To install Splunk in a different directory, use the --prefix flag:

rpm -i --prefix=/opt/new_directory splunk_package_name.rpm

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

I just reread your structure:

/opt/splunk - indexer
/opt/splunk/splunksh - search head
/opt/splunk/splunkforwarder - forwarder

this would be problematic, you would most likely have to do this way:

/opt/splunk/splunkidx - indexer
/opt/splunk/splunksh - search head
/opt/splunk/splunkforwarder - forwarder

MKroki
Explorer

Thank you dgrubb.
I'm thinking the same way as you wrote. Just needed confirmation from someone else.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...