Getting Data In

Is it possible to set up a Splunk deployment with just 1 indexer and 1 search head?

Builder

Is it possible to set up Splunk with Just 1 Indexer, and 1 Search head? I began to attempt this through the Distributed Management Console, but received a nasty warning about not setting up DMC on a box that would be a SH as it would not be supported by Splunk. Is DMC not the way to go for this?

Is it possible to have a setup with only 2 servers (1 sh, 1 indexer)? If so, can someone please provide clear instruction on how to do so as this wasn't clear in the Splunk documentation I've read.

Respectfully,

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Here's all you need to know about adding a search peer (indexer) to a search head: http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Configuredistributedsearch

View solution in original post

SplunkTrust
SplunkTrust

Here's all you need to know about adding a search peer (indexer) to a search head: http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Configuredistributedsearch

View solution in original post

Builder

Thank you, I'd like to vote yours as the correct answer but i'm unsure how to do so. It's only allowing me to accept the first person's response as the answer.. smh

0 Karma

SplunkTrust
SplunkTrust

I have converted the comment, so if this answers your question you can accept it as such.

0 Karma

Ultra Champion

The Small enterprise deployment: Single search head with multiple indexers describes a close enough scenario.

It shows -

alt text

In one of the original courses, they show a transition from one Splunk server to the original one as the Indexer and a new one as a SH. So, what you are trying to do is legitimate ; -)

Builder

I downvoted this post because not the best answer

0 Karma

SplunkTrust
SplunkTrust

Works just fine, just make sure you have the spare capacity to run a few scheduled things from the DMC.

0 Karma

Builder

Can some one provide a how to guide link? I'm unable to find actual instructions on how to set this up. I find lots of articles that tal about the concept and the technology but nothing as granular as.
Cd to bin and type splunk add indexer ..... <--- does something like this exist ? If so is it possible to setup via DMC?

0 Karma

Builder

Anyone have any experience in this? I'm insure of how to set it up as DMC gives me that warning

I imagine there probably a way to do it all through command line if DMC doesn't support . Any direction or walk through / how to's to on how to make this happen is appreciated.

0 Karma