Is it possible to set up a Splunk deployment with just 1 indexer and 1 search head?

[Jarohnimo]

Is it possible to set up Splunk with Just 1 Indexer, and 1 Search head? I began to attempt this through the Distributed Management Console, but received a nasty warning about not setting up DMC on a box that would be a SH as it would not be supported by Splunk. Is DMC not the way to go for this?

Is it possible to have a setup with only 2 servers (1 sh, 1 indexer)? If so, can someone please provide clear instruction on how to do so as this wasn't clear in the Splunk documentation I've read.

Respectfully,

[martin_mueller · Accepted solution]

Here's all you need to know about adding a search peer (indexer) to a search head: http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Configuredistributedsearch

[Jarohnimo]

Thank you, I'd like to vote yours as the correct answer but i'm unsure how to do so. It's only allowing me to accept the first person's response as the answer.. smh

[martin_mueller]

I have converted the comment, so if this answers your question you can accept it as such.

[ddrillic]

The Small enterprise deployment: Single search head with multiple indexers describes a close enough scenario.

It shows -

In one of the original courses, they show a transition from one Splunk server to the original one as the Indexer and a new one as a SH. So, what you are trying to do is legitimate ; -)

[Jarohnimo]

I downvoted this post because not the best answer

[martin_mueller]

Works just fine, just make sure you have the spare capacity to run a few scheduled things from the DMC.

[Jarohnimo]

Can some one provide a how to guide link? I'm unable to find actual instructions on how to set this up. I find lots of articles that tal about the concept and the technology but nothing as granular as.
Cd to bin and type splunk add indexer ..... <--- does something like this exist ? If so is it possible to setup via DMC?

[Jarohnimo]

Anyone have any experience in this? I'm insure of how to set it up as DMC gives me that warning

I imagine there probably a way to do it all through command line if DMC doesn't support . Any direction or walk through / how to's to on how to make this happen is appreciated.