- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
easy home lab directions
cjsweeney1
Explorer
08-12-2019
02:16 PM
Hi looking to renew my power user cert from 6.x to 7.3.1 and looks like the course wants an installation of Splunk which i've loaded.... my question is can the forwarder be on the same PC and the enterprise server? Not how you'll see it in the real world but looking to keep this simple to knock out and i'll spin up some VM's when i get to the admin level courses...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

marycordova

SplunkTrust
08-12-2019
03:08 PM
This is what I would do:
- Host OS Windows with Splunk Enterprise installed and local Windows event logs collected (can configure easy from the UI)
- Guest OS *nix with Universal Forwarder installed and *nix TA setup to collect local logs and forward them to the enterprise install on the host
You can vary this if you prefer a Host on Mac or *nix you can put Windows on the VM. Here is a link to create free Windows 10 installations: https://www.microsoft.com/en-us/software-download/windows10
This setup also supports playing around with Deployment Server since you have a forwarder you can manage "remotely".
@marycordova
