How to configure Splunk Heavy Forwarder and Splunk Searchhead on the same machine?

[sarvesh_11]

Hi @gcusello (tagging u because i have seen many of your answers in this context 🙂 ) ,
Is it possible to configure Splunk Heavy Forwarder and Search head on the same machine?
As our indexer is on Splunk Cloud, for the data formatting, to work on props.conf we need a heavy forwarder in between UF and Indexer. Also, i am restricted for the count of machine i can engage.
What i am left with is, to configure HF and SH on same machine.

TIA

[gcusello · Accepted solution]

Hi sarvesh_11,
Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!
Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.
So you can use a server for both your roles.

The question is: why to do this?
In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.
The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.
In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.

Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).

Bye.
Giuseppe

[o_calmels]

Hi sarvesh_11,

I can see Two ways:
1 - transform your UF in HF
2 - install splunk enterprise on the "SH" server, then configure inputs. conf, outputs.conf and TA if necessary as you should do it on the HF.

A single instance can have multiple roles.

Cheers.

Olivier.