Getting Data In
Highlighted

How to implement clustering and load balancing in Splunk?

Path Finder

Hi,

This question is off-topic for Splunk, but please help me out since I need to set up the configuration urgently.

I have the following Splunk (Splunk-Enterprise) setup:

1. One Windows laptop running Ubuntu (Linux) using VMWare as forwarder.
2. One Laptop running Mac OS as Indexer + Search Head.

I want to try out clustering and load balancing for Splunk. This means I want.

- Windows laptop running Ubuntu (Linux) - to act as 3 servers (completely independent of each other and
listening to different ports)
- Laptop running Mac OS - to act as 3 servers (completely independent of each other and listening to different ports)

Can you please tell me any software that lets me do this, and provide a link if possible?

Thanks,
Deepak

0 Karma
Highlighted

Re: How to implement clustering and load balancing in Splunk?

Path Finder

*NIX OS support multiple splunk instances running on the same OS instance.
Just remember to change ports to avoid conflicts. See this article: https://wiki.splunk.com/Community:RunmultipleSplunksonone_machine

0 Karma
Highlighted

Re: How to implement clustering and load balancing in Splunk?

Path Finder

Thankyou for your response. I am trying this out for a POC, and I need to stick to the strict requirements 😞

Logically, three splunk instances on 1 box and 3 boxes separately running 1 splunk instance each is the same. But since its a POC, I require the latter option.

I will certainly explore the first option later.

0 Karma
Highlighted

Re: How to implement clustering and load balancing in Splunk?

Champion

I've done it before using Oracle Virtual Box.

View solution in original post

0 Karma
Highlighted

Re: How to implement clustering and load balancing in Splunk?

Path Finder

Thankyou very much for your response. Can you maybe give me a link or a list of steps to follows if that is possible?

0 Karma
Highlighted

Re: How to implement clustering and load balancing in Splunk?

Champion

Get the software here, and see this tutorial on how to set up port forwarding. Create three boxes, and set up port 8000 and 8089 to 8000 and 8089 respectively for the first machine. Set it to different ports for the second box (since 8000 and 8089 are already in use from the first one) and so on.
I've created three indexers and five search heads that way on my windows laptop, and went on to set the the three indexers up to be an indexer cluster and the search heads to be a search head cluster. Then, I used the search heads to search the indexers. Apart from juggling all those ports, it was pretty easy.

0 Karma
Highlighted

Re: How to implement clustering and load balancing in Splunk?

Path Finder

Awesome! Let me try it out. Thankyou very much for your help.

0 Karma