Getting Data In

How to configure Splunk Heavy Forwarder and Splunk Searchhead on the same machine?

sarvesh_11
Communicator

Hi @gcusello (tagging u because i have seen many of your answers in this context 🙂 ) ,
Is it possible to configure Splunk Heavy Forwarder and Search head on the same machine?
As our indexer is on Splunk Cloud, for the data formatting, to work on props.conf we need a heavy forwarder in between UF and Indexer. Also, i am restricted for the count of machine i can engage.
What i am left with is, to configure HF and SH on same machine.

TIA

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sarvesh_11,
Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!
Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.
So you can use a server for both your roles.

The question is: why to do this?
In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.
The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.
In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.

Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi sarvesh_11,
Heavy Forwarder is a full Splunk installation where all logs are redirected to Indexers; it's also possible to locally index data but this shouldn't be your requirement!
Search Head is a full Splunk installation used for User Interface and usually, when you configure a SH, it's a good practice to send SH's logs to the indexers, in other words to use it as an HF.
So you can use a server for both your roles.

The question is: why to do this?
In Splunk Cloud you have both Indexers and Search Heads, not only Indexers.
The advantage to have Splunk Cloud is that all the Splunk infrastructure is accessible in cloud.
In addition, in Splunk Cloud you access only Search Heads, you cannot access Indexers! so there's no sense to have a local SH.

Anyway, if you want to do this, remember to correctly dimention your server for both the roles (in terms of CPUs and RAM).

Bye.
Giuseppe

o_calmels
Communicator

Hi sarvesh_11,

I can see Two ways:
1 - transform your UF in HF
2 - install splunk enterprise on the "SH" server, then configure inputs. conf, outputs.conf and TA if necessary as you should do it on the HF.

A single instance can have multiple roles.

Cheers.

Olivier.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...