Getting Data In

How to implement clustering and load balancing in Splunk?

deepak02
Path Finder

Hi,

This question is off-topic for Splunk, but please help me out since I need to set up the configuration urgently.

I have the following Splunk (Splunk-Enterprise) setup:

1. One Windows laptop running Ubuntu (Linux) using VMWare as forwarder.
2. One Laptop running Mac OS as Indexer + Search Head.

I want to try out clustering and load balancing for Splunk. This means I want.

- Windows laptop running Ubuntu (Linux) - to act as 3 servers (completely independent of each other and
listening to different ports)
- Laptop running Mac OS - to act as 3 servers (completely independent of each other and listening to different ports)

Can you please tell me any software that lets me do this, and provide a link if possible?

Thanks,
Deepak

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

I've done it before using Oracle Virtual Box.

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

I've done it before using Oracle Virtual Box.

0 Karma

deepak02
Path Finder

Thankyou very much for your response. Can you maybe give me a link or a list of steps to follows if that is possible?

0 Karma

jeffland
SplunkTrust
SplunkTrust

Get the software here, and see this tutorial on how to set up port forwarding. Create three boxes, and set up port 8000 and 8089 to 8000 and 8089 respectively for the first machine. Set it to different ports for the second box (since 8000 and 8089 are already in use from the first one) and so on.
I've created three indexers and five search heads that way on my windows laptop, and went on to set the the three indexers up to be an indexer cluster and the search heads to be a search head cluster. Then, I used the search heads to search the indexers. Apart from juggling all those ports, it was pretty easy.

0 Karma

deepak02
Path Finder

Awesome! Let me try it out. Thankyou very much for your help.

0 Karma

mirkoneverstops
Path Finder

*NIX OS support multiple splunk instances running on the same OS instance.
Just remember to change ports to avoid conflicts. See this article: https://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

0 Karma

deepak02
Path Finder

Thankyou for your response. I am trying this out for a POC, and I need to stick to the strict requirements 😞

Logically, three splunk instances on 1 box and 3 boxes separately running 1 splunk instance each is the same. But since its a POC, I require the latter option.

I will certainly explore the first option later.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...