Deployment Architecture

Splunk Enterprise POC - Architecture: Is it possible to install a forwarder, indexer, and search head on one Linux box?

deepak02
Path Finder

Hi,

I am well trained in Splunk Dashboarding. I would like to try out a POC of the Splunk Enterprise with the below features (strictly).

  1. The architecture consists of 1 forwarder, 1 indexer and 1 search head all running on Linux boxes, The log file is very small with <100 KB of data.
  2. I want all of the installation/configuration to be done using .conf files.

I have the following questions,
Q1: Can I install the forwarder, indexer and search head together on one Linux box? I am not worried about the performance, I just want to see the data indexed and displayed properly.

Q2: I only have a Windows PC. Can I install Splunk Enterprise on VMWare (which mimics a Unix box) or can I install it on a free online Linux box? - Please provide suggestions

Q3: Is there a Unix way to test that the forwarder is indeed forwarding data to the indexer? (I do not want to check it in Splunk Web)

Thanks,
Deepak

0 Karma
1 Solution

ddrillic
Ultra Champion

Q1 - the Splunk Enterprise software package consists of the indexer, the search head, the deployment server, the license master and more. The Universal Forwarder software package consists of the Universal Forwarder and the deployment client. So, you really need to install only these two packages.

Q2 - you can install the Splunk Enterprise on VMWare. That's what we do.

Q3 - this can help - I can't find my data!

Please let us know how it goes...

View solution in original post

0 Karma

ddrillic
Ultra Champion

Q1 - the Splunk Enterprise software package consists of the indexer, the search head, the deployment server, the license master and more. The Universal Forwarder software package consists of the Universal Forwarder and the deployment client. So, you really need to install only these two packages.

Q2 - you can install the Splunk Enterprise on VMWare. That's what we do.

Q3 - this can help - I can't find my data!

Please let us know how it goes...

0 Karma

deepak02
Path Finder

It worked yay!!!!!

I was able to see data from forwarder on the indexer, but am getting an error on the search head-indexer connection.

When search head tries to connect to the indexer, the error is:

Error [00000080] Failed 12 out of 11 times.REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd.log on the peer.

Thanks for all your advice so far. Will you be able to help me on this too please...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...