How to set up an environment with an indexer on one machine and a search head on another?

[ahmedhassanean]

Dears,

May I know please if it's possible to have a setup in which I will have only two machines: one of them will act as Indexer and the other to act as Search Head, and if it's possible, how can I achieve that?

thanks in advance

[richgalloway · Accepted solution]

Yes, it is definitely possible and I've done it. Install Splunk on both machines. Make your search head a license master and the indexer a license slave. On the search head, go to Settings->Distributed Search->Search Peers and click the New button to add your indexer as a peer. Configure your inputs on the indexer. If you run universal forwarders, have them send data to the indexer.

See http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/Overviewofconfiguration for more information.