Splunk Practice Environment

[itsmevic]

I'd like to set up a practice Splunk environment so that I can practice various install methods of Splunk (clustering, distributed, standalone AIO, etc). I have chosen Linux as my OS build for all of my EC2 instances on AWS, but I am unsure if it would just be easier to set up a 4 or 5 instance environment (Monitoring Console, forwarder, 2 indexers, search head) in Virtualbox? In going that route I know I would need a crap-ton of memory and CPU on each virtual image in order to support Splunk min specs. I just need some good recommendations as to what is going to be the best environment to use in setting up a solid Splunk learning environment that I can practice in. Thanks for your help.

[skalliger]

The hardware requirements you're referring to has nothing to do with what can be set-up.
Splunk can be installed on almost any machine with a CPU, some RAM and free disk space (>= 5 GB, some other restrictions apply of course). For testing purposes, you don't have to meet the minimum HW requirements. That docs page lists just the minimum specs that are supported. You can run a SH on 2 vCPUs and 2 GB RAM. You won't have much fun though.

Skalli

[gfreitas]

If it is completely for you to practice and won't expect to be running any scheduled searches, modular inputs etc I don't see why not using Virtual Box. I have used many times VirtualBox with lots of servers and using small amount of memory and CPU. I used many times 2 CPU cores and 1 GB RAM if that is for testing very small things.

If you want to setup a bigger test deployment where you want to create scheduled searches, share the Splunk server with others and develop something then it would be better to use the minimum reqs on AWS.