We have splunk-light 1GB per day license. We expect about 400 MB of events on a normal day. I'd like to set up one splunk instance then multiple instances of universal forwarder (UF) on a few other linux servers.
How do I, and do I need to, configure splunk as a search head, indexer and deployment server for UF to be able to transmit events to splunk and then search the same server instance.
All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.
The basic steps are:
1: Stand Up a new Search Head to use as DS. 2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/ 3: Create a serverclass.conf file on the DS (put your forwarder and app details in there). 4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.
Thanks. How can I make it a deployment server so that I can test it and see if it can handle the volume. I am limited on hardware availability right now.
Woodcock - Your 4 steps did the trick. That was what was what I needed to fill in the gaps in the volumes of documentation from splunk. We have a qa server now forwarding 3 log files. I expect to get our production servers forwarding this week.
Thank You very much.