Deployment Architecture

Can multiple instances be installed under the same path?

MKroki
Explorer

Hi,
Is it possible to have multiple instances under the same path.
Splunk 6.3.1.
One machine (linux)

For example:

/opt/splunk - indexer
/opt/splunk/splunksh - search head
/opt/splunk/splunkforwarder - forwarder

Thanks

Tags (1)
0 Karma
1 Solution

dgrubb_splunk
Splunk Employee
Splunk Employee

Yes you can, really good for building a simple dev environment. But although you can I wouldn't do that for production systems.

View solution in original post

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

Yes you can, really good for building a simple dev environment. But although you can I wouldn't do that for production systems.

0 Karma

MKroki
Explorer

Thanks for answer. I have same thoughts.
I'm wondering, will be problems with upgrading in future if (in same example) indexer is installed with rpm package and other two with tgz package. Will rpm run over search head instance and forwarder instance, because rpm default installation path is /opt/splunk/

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

To install Splunk in a different directory, use the --prefix flag:

rpm -i --prefix=/opt/new_directory splunk_package_name.rpm

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

I just reread your structure:

/opt/splunk - indexer
/opt/splunk/splunksh - search head
/opt/splunk/splunkforwarder - forwarder

this would be problematic, you would most likely have to do this way:

/opt/splunk/splunkidx - indexer
/opt/splunk/splunksh - search head
/opt/splunk/splunkforwarder - forwarder

MKroki
Explorer

Thank you dgrubb.
I'm thinking the same way as you wrote. Just needed confirmation from someone else.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...