We have splunk-light 1GB per day license. We expect about 400 MB of events on a normal day. I'd like to set up one splunk instance then multiple instances of universal forwarder (UF) on a few other linux servers.
How do I, and do I need to, configure splunk as a search head, indexer and deployment server for UF to be able to transmit events to splunk and then search the same server instance.
All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.
See here for DS:
https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066
The basic steps are:
1: Stand Up a new Search Head to use as DS.
2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/
3: Create a serverclass.conf file on the DS (put your forwarder and app details in there).
4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.
All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.
See here for DS:
https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066
The basic steps are:
1: Stand Up a new Search Head to use as DS.
2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/
3: Create a serverclass.conf file on the DS (put your forwarder and app details in there).
4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.
Woodcock - Your 4 steps did the trick. That was what was what I needed to fill in the gaps in the volumes of documentation from splunk. We have a qa server now forwarding 3 log files. I expect to get our production servers forwarding this week.
Thank You very much.
Thanks. How can I make it a deployment server so that I can test it and see if it can handle the volume. I am limited on hardware availability right now.
In addition to woodcock's excellent answer, you can also refer to the Splunk Light documentation topic Getting data into Splunk Light using Linux
Answer updated.