Getting Data In

Is it possible to set up a Splunk deployment with just 1 indexer and 1 search head?

Jarohnimo
Builder

Is it possible to set up Splunk with Just 1 Indexer, and 1 Search head? I began to attempt this through the Distributed Management Console, but received a nasty warning about not setting up DMC on a box that would be a SH as it would not be supported by Splunk. Is DMC not the way to go for this?

Is it possible to have a setup with only 2 servers (1 sh, 1 indexer)? If so, can someone please provide clear instruction on how to do so as this wasn't clear in the Splunk documentation I've read.

Respectfully,

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Here's all you need to know about adding a search peer (indexer) to a search head: http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Configuredistributedsearch

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Here's all you need to know about adding a search peer (indexer) to a search head: http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Configuredistributedsearch

Jarohnimo
Builder

Thank you, I'd like to vote yours as the correct answer but i'm unsure how to do so. It's only allowing me to accept the first person's response as the answer.. smh

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I have converted the comment, so if this answers your question you can accept it as such.

0 Karma

ddrillic
Ultra Champion

The Small enterprise deployment: Single search head with multiple indexers describes a close enough scenario.

It shows -

alt text

In one of the original courses, they show a transition from one Splunk server to the original one as the Indexer and a new one as a SH. So, what you are trying to do is legitimate ; -)

Jarohnimo
Builder

I downvoted this post because not the best answer

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Works just fine, just make sure you have the spare capacity to run a few scheduled things from the DMC.

0 Karma

Jarohnimo
Builder

Can some one provide a how to guide link? I'm unable to find actual instructions on how to set this up. I find lots of articles that tal about the concept and the technology but nothing as granular as.
Cd to bin and type splunk add indexer ..... <--- does something like this exist ? If so is it possible to setup via DMC?

0 Karma

Jarohnimo
Builder

Anyone have any experience in this? I'm insure of how to set it up as DMC gives me that warning

I imagine there probably a way to do it all through command line if DMC doesn't support . Any direction or walk through / how to's to on how to make this happen is appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...