Deployment Architecture

Splunk Enterprise POC - Architecture: Is it possible to install a forwarder, indexer, and search head on one Linux box?

deepak02
Path Finder

Hi,

I am well trained in Splunk Dashboarding. I would like to try out a POC of the Splunk Enterprise with the below features (strictly).

  1. The architecture consists of 1 forwarder, 1 indexer and 1 search head all running on Linux boxes, The log file is very small with <100 KB of data.
  2. I want all of the installation/configuration to be done using .conf files.

I have the following questions,
Q1: Can I install the forwarder, indexer and search head together on one Linux box? I am not worried about the performance, I just want to see the data indexed and displayed properly.

Q2: I only have a Windows PC. Can I install Splunk Enterprise on VMWare (which mimics a Unix box) or can I install it on a free online Linux box? - Please provide suggestions

Q3: Is there a Unix way to test that the forwarder is indeed forwarding data to the indexer? (I do not want to check it in Splunk Web)

Thanks,
Deepak

0 Karma
1 Solution

ddrillic
Ultra Champion

Q1 - the Splunk Enterprise software package consists of the indexer, the search head, the deployment server, the license master and more. The Universal Forwarder software package consists of the Universal Forwarder and the deployment client. So, you really need to install only these two packages.

Q2 - you can install the Splunk Enterprise on VMWare. That's what we do.

Q3 - this can help - I can't find my data!

Please let us know how it goes...

View solution in original post

0 Karma

ddrillic
Ultra Champion

Q1 - the Splunk Enterprise software package consists of the indexer, the search head, the deployment server, the license master and more. The Universal Forwarder software package consists of the Universal Forwarder and the deployment client. So, you really need to install only these two packages.

Q2 - you can install the Splunk Enterprise on VMWare. That's what we do.

Q3 - this can help - I can't find my data!

Please let us know how it goes...

0 Karma

deepak02
Path Finder

It worked yay!!!!!

I was able to see data from forwarder on the indexer, but am getting an error on the search head-indexer connection.

When search head tries to connect to the indexer, the error is:

Error [00000080] Failed 12 out of 11 times.REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd.log on the peer.

Thanks for all your advice so far. Will you be able to help me on this too please...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...