Splunk Enterprise POC - Architecture: Is it possible to install a forwarder, indexer, and search head on one Linux box?

[deepak02]

Hi,

I am well trained in Splunk Dashboarding. I would like to try out a POC of the Splunk Enterprise with the below features (strictly).

1. The architecture consists of 1 forwarder, 1 indexer and 1 search head all running on Linux boxes, The log file is very small with <100 KB of data.
2. I want all of the installation/configuration to be done using .conf files.

I have the following questions,
Q1: Can I install the forwarder, indexer and search head together on one Linux box? I am not worried about the performance, I just want to see the data indexed and displayed properly.

Q2: I only have a Windows PC. Can I install Splunk Enterprise on VMWare (which mimics a Unix box) or can I install it on a free online Linux box? - Please provide suggestions

Q3: Is there a Unix way to test that the forwarder is indeed forwarding data to the indexer? (I do not want to check it in Splunk Web)

Thanks,
Deepak

[ddrillic · Accepted solution]

Q1 - the Splunk Enterprise software package consists of the indexer, the search head, the deployment server, the license master and more. The Universal Forwarder software package consists of the Universal Forwarder and the deployment client. So, you really need to install only these two packages.

Q2 - you can install the Splunk Enterprise on VMWare. That's what we do.

Q3 - this can help - I can't find my data!

Please let us know how it goes...

[deepak02]

It worked yay!!!!!

I was able to see data from forwarder on the indexer, but am getting an error on the search head-indexer connection.

When search head tries to connect to the indexer, the error is:

Error [00000080] Failed 12 out of 11 times.REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd.log on the peer.

Thanks for all your advice so far. Will you be able to help me on this too please...