Hi - I am using Splunk Enterprise Trial license at home network for learning purpose.
I have installed Splunk(Linux) on my two machines within home network.
When I try to change the license configuration to Slave in one of the machine to make one as master and another as slave, it gives below error..
"Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: This license does not support being a remote master. from ip="
As per documentation, distributed indexing is possible with Splunk Enterprise Trial license. Am I missing something?
Hey Manoj, are you trying to add One Ent Splunk Trial linux instance as a trial to second Ent Splunk Trial instance? If yes, it's not going to work as they are trial instances any way. Can point to a Master which has a purchased license key only.
Are you trying to use one instance as search heads and the second as indexer? If yes, distributed search is what you're looking for.
Pick an instance to be search head, click on Settings>>Distributed Search >> Search Peers>>Add New
Enter the Second instance's ip address followed by Management port. Something like 126.96.36.199:8089 and save.
Now you should have a dedicated search head and a dedicated indexer. Hope this help!
Unfortunately, No is the answer.
Respective features are not available in Trail/Free.
Hope, Below link can help you better.
All the best and Keep splunking.
You could also request a splunk dev license. It will allow you to do the funky stuff like index clustering and search head clustering, and allows you to index 10G/day. It is great for home/lab set-ups like you describe you have.