Splunk free - setting up a distributed environement (Search Head, 1 IDX, 1 UF, maybe a deployment server)

[spluzer]

Hey Splunksters,

My work environment is switching from Windows (large distributed enviro) to Linux pretty soon.

I'd like to get familiar with architecting in Linux so I had a couple of questions:

I'm wondering if I can simply spin up 3-5 aws linux vm's and use the free version of splunk to get familiar with the process of creating a distributed enviro (assigning a search head, 1 idx, maybe couple of forwarders and a deployment server using the free splunk??? 

Or, is the free splunk Enterprise only good for 1 download on 1 machine ??

Thanks!

[harsmarvania57 · Accepted solution]

Hi,

Yes you can setup multiple VMs for different Splunk role with Splunk Entrprise (which has 500MB license for 60 days).

[isoutamo]

But you cannot use separate LM. Use local trial licenses in all nodes.

[ragedsparrow]

Greetings,

Splunk Free is only available for a single, stand-alone instance.  You will be unable to build a distributed environment with a Splunk Free license.

[ragedsparrow]

However, as previously mentioned, you could use the Splunk Enterprise Trial license to do what  you're wanting.