setup splunk/forwader in the same platform

[AL3Z]

Hi,

I want to setup a home lab like splunk Enterprise and splunk forwarder on the same os to pull the logs into splunk. Is it possible to setup in this way.

[isoutamo]

Hi

the easiest way is use separate virtual machines, but you could do it also e.g. on linux box on lab env. In production this is not proposed way to do it.

In linux you can just install 1st indexers and start it. Then you could install UF and start it with different ports for mgmt and probably some other. You just must check correct parameters from docs (I cannot find those now). But if I recall right UF tell that normal ports are reserved and ask to use some other ports.

r. Ismo

[AL3Z]

@gcusello ,
I am looking for only forwarder and Indexer.

[gcusello]

Hi @AL3Z ,

in this case, you have to configure two virtual machines that are connected:

one with Splunk Enterprise and one with Splunk Universal Forwarder.

Ciao.

Giuseppe

[gcusello]

Hi @AL3Z ,

yes, it's possible, but you should define the purpose, the borders and the Use Cases of your lab.

In other words: what architecture you need to test: a distributed environment? only forwarder and Indexer? what else?

In my lab I have seved virtual machines with

• two Indexers,
• three Search Heads,
• a Management Node (Cluster Manager, Deployer, License Master, Monitoring Console and Deployment Server),
• one Universal Forwarder.

I did it on pc pc that hase 16 vCPUs and 32 GB TAM).

As I said, you can do this, it depends on your requirements and the resources you have.

Ciao.

Giuseppe