Getting Data In
Highlighted

how to install single splunk instance on linux

Explorer

We have splunk-light 1GB per day license. We expect about 400 MB of events on a normal day. I'd like to set up one splunk instance then multiple instances of universal forwarder (UF) on a few other linux servers.

How do I, and do I need to, configure splunk as a search head, indexer and deployment server for UF to be able to transmit events to splunk and then search the same server instance.

0 Karma
Highlighted

Re: how to install single splunk instance on linux

Esteemed Legend

All splunk instances (except UF) are Indexers and Search Heads by default. I would not make your main box also a DS but it can work if you have very few Forwarders.

See here for DS:
https://answers.splunk.com/answers/418065/how-do-we-set-up-the-deployment-server.html#answer-418066

The basic steps are:

1: Stand Up a new Search Head to use as DS.
2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/
3: Create a serverclass.conf file on the DS (put your forwarder and app details in there).
4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.

View solution in original post

Highlighted

Re: how to install single splunk instance on linux

Explorer

Thanks. How can I make it a deployment server so that I can test it and see if it can handle the volume. I am limited on hardware availability right now.

0 Karma
Highlighted

Re: how to install single splunk instance on linux

Esteemed Legend

Answer updated.

0 Karma
Highlighted

Re: how to install single splunk instance on linux

Splunk Employee
Splunk Employee

In addition to woodcock's excellent answer, you can also refer to the Splunk Light documentation topic Getting data into Splunk Light using Linux

Highlighted

Re: how to install single splunk instance on linux

Explorer

Woodcock - Your 4 steps did the trick. That was what was what I needed to fill in the gaps in the volumes of documentation from splunk. We have a qa server now forwarding 3 log files. I expect to get our production servers forwarding this week.

Thank You very much.

0 Karma