I am well trained in Splunk Dashboarding. I would like to try out a POC of the Splunk Enterprise with the below features (strictly).
I have the following questions,
Q1: Can I install the forwarder, indexer and search head together on one Linux box? I am not worried about the performance, I just want to see the data indexed and displayed properly.
Q2: I only have a Windows PC. Can I install Splunk Enterprise on VMWare (which mimics a Unix box) or can I install it on a free online Linux box? - Please provide suggestions
Q3: Is there a Unix way to test that the forwarder is indeed forwarding data to the indexer? (I do not want to check it in Splunk Web)
Q1 - the Splunk Enterprise software package consists of the indexer, the search head, the deployment server, the license master and more. The Universal Forwarder software package consists of the Universal Forwarder and the deployment client. So, you really need to install only these two packages.
Q2 - you can install the Splunk Enterprise on VMWare. That's what we do.
Q3 - this can help - I can't find my data!
Please let us know how it goes...
It worked yay!!!!!
I was able to see data from forwarder on the indexer, but am getting an error on the search head-indexer connection.
When search head tries to connect to the indexer, the error is:
Error  Failed 12 out of 11 times.REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd.log on the peer.
Thanks for all your advice so far. Will you be able to help me on this too please...