how to deploy search head and indexer

[smdasim]

Hi
how to deploy search head and indexer with detailed steps
regards
smdasim

[woodcock · Accepted solution]

Create your server instances (2) and Install Linux.
Install Splunk Enterprise.
Create admin user.
On the one that is to be the Search Head:
1: Configure outputs.conf to send stuff to the Indexer
2: Configure Settings -> Distributed Search -> Search Peers -> Add to be able to search data on the Indexer.

[smdasim]

Hi Wookcock,
thanks for Search Head commands ,what about the indexer setup?
Regards
smdasim

[woodcock]

Everything is an Indexer by default. It should be listening on port 9997 out of the box.

[smdasim]

Woodcock,
thank you !!
Much appreciated for your inputs !!!

[renjith_nair]

Hi @smdasim,

You can start from here : http://docs.splunk.com/Documentation/Splunk/7.1.1/Installation/Whatsinthismanual

Based on your environment and deployment model (distributed,cluste,etc) you shall follow the respective links.

Please lets know if you need any further assistance in any of the steps.

[renjith_nair]

Hi @smdasim, lets know if still have questions

[smdasim]

Hi renjith.nair,
Can you please give me links for basic setup required for architecture certification lab.
regards
smdasim

[renjith_nair]

As per the https://www.splunk.com/pdfs/training/splunk-architect-certification-lab.pdf

You might need a
- Deployment server
- Indexer cluster
- Forwarder Installation (automatic)
- Search head in indexer cluster

Also practice search head cluster