Installation

Elasticsearch -> Splunk : Getting started?

lrodrigues99
New Member

Good morning. I support a application development effort which is transitioning from Elasticsearch to Splunk. 

I would like to setup a POC test instance/cluster of splunk on our dev network.

With elastic, I would dimply download an RPM ang get started.

With splunk, it is unclear to me how to get started (reading docs), regarding licensing and which files I can download.

Apologies for the low level questions, but where can I get started?  Which file can I download to start install an instance, and hopefully created a small (3/4 node) cluster for POC?

Thanks,

Larry

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I recommend starting with a single standalone instance of Splunk before venturing into clustering.  Walk before you run.

As for which file to download, you will need to start with Splunk Enterprise so go to https://www.splunk.com/en_us/download/splunk-enterprise.html and download the RPM. Don't worry about licensing as it comes with a built-in 60-day license.

Depending on where your data resides, you may also need to download and installed one or more Universal Forwarders from https://www.splunk.com/en_us/download/universal-forwarder.html and configure it to send data to the Splunk Enterprise instance.  See https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/Abouttheuniversalforwarder for how to do that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @lrodrigues99,

with Splunk you can download a free instance (max 500 MB/day) and use it for 60 days with full features, and then with a subset of features.

If for your PoC you need more volume of logs, you can ask to Splunk a trial version for a more limited time period (usually 2 weeks).

To download a free installation you need only an account on splunk.com.

Installation depends on the Operative system you're using for the Splunk server.

If Linux, you have to download an rpm or a tar, explode it and then run a command.

./splunk start --accept-license

You can find the installation procedure at https://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonLinux

You can also find some videos that describe this procedure https://www.splunk.com/en_us/resources/videos/installing-splunk-enterprise-on-linux.html

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...