Getting Data In

how to install single splunk instance on linux

daddyoh
Explorer

We have splunk-light 1GB per day license. We expect about 400 MB of events on a normal day. I'd like to set up one splunk instance then multiple instances of universal forwarder (UF) on a few other linux servers.

How do I, and do I need to, configure splunk as a search head, indexer and deployment server for UF to be able to transmit events to splunk and then search the same server instance.

0 Karma
1 Solution

woodcock
Esteemed Legend

All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.

See here for DS:
https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066

The basic steps are:

1: Stand Up a new Search Head to use as DS.
2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/
3: Create a serverclass.conf file on the DS (put your forwarder and app details in there).
4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.

View solution in original post

woodcock
Esteemed Legend

All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.

See here for DS:
https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066

The basic steps are:

1: Stand Up a new Search Head to use as DS.
2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/
3: Create a serverclass.conf file on the DS (put your forwarder and app details in there).
4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.

View solution in original post

daddyoh
Explorer

Woodcock - Your 4 steps did the trick. That was what was what I needed to fill in the gaps in the volumes of documentation from splunk. We have a qa server now forwarding 3 log files. I expect to get our production servers forwarding this week.

Thank You very much.

0 Karma

daddyoh
Explorer

Thanks. How can I make it a deployment server so that I can test it and see if it can handle the volume. I am limited on hardware availability right now.

0 Karma

andrewb_splunk
Splunk Employee
Splunk Employee

In addition to woodcock's excellent answer, you can also refer to the Splunk Light documentation topic Getting data into Splunk Light using Linux

woodcock
Esteemed Legend

Answer updated.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!