Splunk Search

Splunk Installation.

VijayA
Explorer

Hi,

I'm new to Splunk, trying to understand for Splunk we have 1 installation we need to customize it to work as Forwarder or Indexer or Search Head, So want to know which all files need to modify to work as forwarder or indexer.

Correct me if my understanding is wrong.

Please advise thanks.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @VijayA,

A Splunk Enterprise installation can work as an Indexer, a Search or a Heavy Forwarder: the installation packet is always the same, and the role depends on the configuration.

What is the architecture you want to implement?

if you want a distributed architecture, you have to configure at least one Indexer and one Search Head, the difference is that the Indexer indexes logs and the Search Head is the user Front end.

Otherwise, you could have a Stand Alone server where the same server is the Indexer and the Search Head.

Instaed the Heavy Forwarder is used e.g. to pull logs from cloud or to receive syslogs.

Anyway, the server role depemds on your requirement: what are your requirements?

I hint to read the document https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf that gives you an overview of the possible architectures, at the same time I hint to contact a Splunk partner to analyze your requiremts and design your architecture, It isn't a good idea to start without any knowledge about Splunk architectures and features..

Ciao.

Giuseppe

View solution in original post

VijayA
Explorer

Thank you for your inputs and document.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VijayA,

A Splunk Enterprise installation can work as an Indexer, a Search or a Heavy Forwarder: the installation packet is always the same, and the role depends on the configuration.

What is the architecture you want to implement?

if you want a distributed architecture, you have to configure at least one Indexer and one Search Head, the difference is that the Indexer indexes logs and the Search Head is the user Front end.

Otherwise, you could have a Stand Alone server where the same server is the Indexer and the Search Head.

Instaed the Heavy Forwarder is used e.g. to pull logs from cloud or to receive syslogs.

Anyway, the server role depemds on your requirement: what are your requirements?

I hint to read the document https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf that gives you an overview of the possible architectures, at the same time I hint to contact a Splunk partner to analyze your requiremts and design your architecture, It isn't a good idea to start without any knowledge about Splunk architectures and features..

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...