Single Search Head and Indexer Configuration Help

[qazwsxedc994]

I am looking to configure a single search head and indexer for testing purposes, however i cant seem to find any clear documentation to help me as everything seems to be related to clusters. How do i go about configuring single instances? What do i use a master_uri?

[laserval]

What you're looking for is covered mostly in the Distributed Search documentation: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration

Here's a setup with a single search head and a single indexer:

1. Install Splunk on each machine
2. Indexer: Enable receiving
3. Search Head: Enable forwarding of all data (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata)
4. Search Head: Add the indexer as a search peer (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuredistributedsearch)
5. Indexer: Configure as license slave to the Search Head (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurealicenseslave)

You can also disable the ui on the indexer, to make sure that you always search from the search head.

I also like setting up the search head as a deployment server, that deploys the configuration for the indexer. That way you get a single machine to find all the configuration on.

Note that you will have to create indexes on the indexer, not via the search head UI. There is more info in the documentation on distributed search and what it means for administration of Splunk.