how to install single splunk instance on linux

[daddyoh]

We have splunk-light 1GB per day license. We expect about 400 MB of events on a normal day. I'd like to set up one splunk instance then multiple instances of universal forwarder (UF) on a few other linux servers.

How do I, and do I need to, configure splunk as a search head, indexer and deployment server for UF to be able to transmit events to splunk and then search the same server instance.

[woodcock · Accepted solution]

All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.

See here for DS:
https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066

The basic steps are:

1: Stand Up a new Search Head to use as DS.
2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/
3: Create a serverclass.conf file on the DS (put your forwarder and app details in there).
4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.

[daddyoh]

Woodcock - Your 4 steps did the trick. That was what was what I needed to fill in the gaps in the volumes of documentation from splunk. We have a qa server now forwarding 3 log files. I expect to get our production servers forwarding this week.

Thank You very much.

[daddyoh]

Thanks. How can I make it a deployment server so that I can test it and see if it can handle the volume. I am limited on hardware availability right now.

[andrewb_splunk]

In addition to woodcock's excellent answer, you can also refer to the Splunk Light documentation topic Getting data into Splunk Light using Linux

[woodcock]

Answer updated.