Splunk Distrubuted Deployment in my Local System

[rakshithreddy]

Hi all,

I am trying to set up a small Splunk distributed deployment in my Local System.
with
3 Indexers
Master
1 Search Head
License Master ( Enterprise Trial 60 days License )

When I was trying to add the slaves to License Master, Its keep on getting this error -

Bad Request — In handler 'localslave': editTracker failed, reason='Unable to connect to license master:

Question:
Can I create a Distributed Setup using Enterprise Trial License?
can I request Splunk support for Trial License which can work with this setup?

Thank you

[koshyk · Accepted solution]

I think, you are hitting some basic issues. So my suggestion is you to learn a bit more into making settings correctly and read the configs to setup a larger cluster system. Please find suggestions in order of preference
1. Get a developer license (10GB per day) with full license options. Its free.
2. Setup a standalone System with SH, IDX all in same machine with license . Check everything is working
3. Now create 4 indexers separately and use a Cluster Master
4. Now split license server outside and so on..
5. Finally make a SH cluster

If you don't want to have all the pain, Use docker. Best docker images are
1. Full blown Splunk-n-box => https://github.com/mhassan2/splunk-n-box
2. Simpler Docker Splunk => https://github.com/getkub/docker_splunk

You can then customise the docker setup to bring up all the cluster etc, rather than having individual installations in VM