Getting Data In

How to implement clustering and load balancing in Splunk?

deepak02
Path Finder

Hi,

This question is off-topic for Splunk, but please help me out since I need to set up the configuration urgently.

I have the following Splunk (Splunk-Enterprise) setup:

1. One Windows laptop running Ubuntu (Linux) using VMWare as forwarder.
2. One Laptop running Mac OS as Indexer + Search Head.

I want to try out clustering and load balancing for Splunk. This means I want.

- Windows laptop running Ubuntu (Linux) - to act as 3 servers (completely independent of each other and
listening to different ports)
- Laptop running Mac OS - to act as 3 servers (completely independent of each other and listening to different ports)

Can you please tell me any software that lets me do this, and provide a link if possible?

Thanks,
Deepak

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

I've done it before using Oracle Virtual Box.

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

I've done it before using Oracle Virtual Box.

0 Karma

deepak02
Path Finder

Thankyou very much for your response. Can you maybe give me a link or a list of steps to follows if that is possible?

0 Karma

jeffland
SplunkTrust
SplunkTrust

Get the software here, and see this tutorial on how to set up port forwarding. Create three boxes, and set up port 8000 and 8089 to 8000 and 8089 respectively for the first machine. Set it to different ports for the second box (since 8000 and 8089 are already in use from the first one) and so on.
I've created three indexers and five search heads that way on my windows laptop, and went on to set the the three indexers up to be an indexer cluster and the search heads to be a search head cluster. Then, I used the search heads to search the indexers. Apart from juggling all those ports, it was pretty easy.

0 Karma

deepak02
Path Finder

Awesome! Let me try it out. Thankyou very much for your help.

0 Karma

mirkoneverstops
Path Finder

*NIX OS support multiple splunk instances running on the same OS instance.
Just remember to change ports to avoid conflicts. See this article: https://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

0 Karma

deepak02
Path Finder

Thankyou for your response. I am trying this out for a POC, and I need to stick to the strict requirements 😞

Logically, three splunk instances on 1 box and 3 boxes separately running 1 splunk instance each is the same. But since its a POC, I require the latter option.

I will certainly explore the first option later.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...