Getting Data In

How to configure Splunk Heavy Forwarder and Splunk Searchhead on the same machine?

sarvesh_11
Communicator

Hi @gcusello (tagging u because i have seen many of your answers in this context 🙂 ) ,
Is it possible to configure Splunk Heavy Forwarder and Search head on the same machine?
As our indexer is on Splunk Cloud, for the data formatting, to work on props.conf we need a heavy forwarder in between UF and Indexer. Also, i am restricted for the count of machine i can engage.
What i am left with is, to configure HF and SH on same machine.

TIA

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sarvesh_11,
Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!
Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.
So you can use a server for both your roles.

The question is: why to do this?
In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.
The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.
In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.

Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi sarvesh_11,
Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!
Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.
So you can use a server for both your roles.

The question is: why to do this?
In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.
The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.
In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.

Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).

Bye.
Giuseppe

o_calmels
Communicator

Hi sarvesh_11,

I can see Two ways:
1 - transform your UF in HF
2 - install splunk enterprise on the "SH" server, then configure inputs. conf, outputs.conf and TA if necessary as you should do it on the HF.

A single instance can have multiple roles.

Cheers.

Olivier.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...