How to implement clustering and load balancing in Splunk?

[deepak02]

Hi,

This question is off-topic for Splunk, but please help me out since I need to set up the configuration urgently.

I have the following Splunk (Splunk-Enterprise) setup:

1. One Windows laptop running Ubuntu (Linux) using VMWare as forwarder.
2. One Laptop running Mac OS as Indexer + Search Head.

I want to try out clustering and load balancing for Splunk. This means I want.

- Windows laptop running Ubuntu (Linux) - to act as 3 servers (completely independent of each other and
listening to different ports)
- Laptop running Mac OS - to act as 3 servers (completely independent of each other and listening to different ports)

Can you please tell me any software that lets me do this, and provide a link if possible?

Thanks,
Deepak

[jeffland · Accepted solution]

I've done it before using Oracle Virtual Box.

[deepak02]

Thankyou very much for your response. Can you maybe give me a link or a list of steps to follows if that is possible?

[jeffland]

Get the software here, and see this tutorial on how to set up port forwarding. Create three boxes, and set up port 8000 and 8089 to 8000 and 8089 respectively for the first machine. Set it to different ports for the second box (since 8000 and 8089 are already in use from the first one) and so on.
I've created three indexers and five search heads that way on my windows laptop, and went on to set the the three indexers up to be an indexer cluster and the search heads to be a search head cluster. Then, I used the search heads to search the indexers. Apart from juggling all those ports, it was pretty easy.

[deepak02]

Awesome! Let me try it out. Thankyou very much for your help.

[mirkoneverstops]

*NIX OS support multiple splunk instances running on the same OS instance.
Just remember to change ports to avoid conflicts. See this article: https://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

[deepak02]

Thankyou for your response. I am trying this out for a POC, and I need to stick to the strict requirements 😞

Logically, three splunk instances on 1 box and 3 boxes separately running 1 splunk instance each is the same. But since its a POC, I require the latter option.

I will certainly explore the first option later.