Getting Data In

How do I run a universal forwarder on an indexer that's handling non-IT data?

gpullis
Communicator

I need to create a standalone Splunk instance to handle health data (about the health of humans. Non-IT data).

So, I want to forward its /var/log/* data to my main indexer like any other server.

Is there a way to have a universal forwarder and an unrelated indexer living on the same server? What are the caveats in setting that up?

0 Karma

ddrillic
Ultra Champion

You should probably be fine with one Splunk instance. Licensing-wise, you can segregate it via license pooling, which was built exactly for such a use case.

0 Karma

gpullis
Communicator

So, I would stand up a second indexer, connect it to my first indexer, and have my health data go to the second indexer and all my IT data go to the first indexer?

But then I'm centrally managing everything?

And either indexer could be used as a search head for all the data? And, when it comes time to separate my search heads and indexers my new search heads would be searching across both indexers?

As you can see, we haven't scaled beyond a single Splunk indexer / search head yet. But, am I getting the general principle right?

0 Karma

gfreitas
Builder

Yes, you can have two splunk instances on the same machine (just change the ports). But you can have both data on the same Splunk, two different Indexes (not indexers) and two access profiles for your users: IT person have access to IT Index and doctors have access to health Index.

0 Karma

gpullis
Communicator

Thanks. I'll try to install an indexer on the same machine as a configured forwarder and see how it goes.

We wanted to separate them because we're certain we'll never need to correlate their data with ours and we didn't want their work to impact the licensing or performance of our Splunk deployment.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...