Getting Data In

How to configure Splunk Heavy Forwarder and Splunk Searchhead on the same machine?

sarvesh_11
Communicator

Hi @gcusello (tagging u because i have seen many of your answers in this context 🙂 ) ,
Is it possible to configure Splunk Heavy Forwarder and Search head on the same machine?
As our indexer is on Splunk Cloud, for the data formatting, to work on props.conf we need a heavy forwarder in between UF and Indexer. Also, i am restricted for the count of machine i can engage.
What i am left with is, to configure HF and SH on same machine.

TIA

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sarvesh_11,
Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!
Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.
So you can use a server for both your roles.

The question is: why to do this?
In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.
The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.
In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.

Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi sarvesh_11,
Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!
Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.
So you can use a server for both your roles.

The question is: why to do this?
In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.
The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.
In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.

Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).

Bye.
Giuseppe

o_calmels
Communicator

Hi sarvesh_11,

I can see Two ways:
1 - transform your UF in HF
2 - install splunk enterprise on the "SH" server, then configure inputs. conf, outputs.conf and TA if necessary as you should do it on the HF.

A single instance can have multiple roles.

Cheers.

Olivier.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...