Splunk Search

Splunk Practice Environment

itsmevic
Communicator

I'd like to set up a practice Splunk environment so that I can practice various install methods of Splunk (clustering, distributed, standalone AIO, etc). I have chosen Linux as my OS build for all of my EC2 instances on AWS, but I am unsure if it would just be easier to set up a 4 or 5 instance environment (Monitoring Console, forwarder, 2 indexers, search head) in Virtualbox? In going that route I know I would need a crap-ton of memory and CPU on each virtual image in order to support Splunk min specs. I just need some good recommendations as to what is going to be the best environment to use in setting up a solid Splunk learning environment that I can practice in. Thanks for your help.

0 Karma

skalliger
Motivator

The hardware requirements you're referring to has nothing to do with what can be set-up.
Splunk can be installed on almost any machine with a CPU, some RAM and free disk space (>= 5 GB, some other restrictions apply of course). For testing purposes, you don't have to meet the minimum HW requirements. That docs page lists just the minimum specs that are supported. You can run a SH on 2 vCPUs and 2 GB RAM. You won't have much fun though.

Skalli

0 Karma

gfreitas
Builder

If it is completely for you to practice and won't expect to be running any scheduled searches, modular inputs etc I don't see why not using Virtual Box. I have used many times VirtualBox with lots of servers and using small amount of memory and CPU. I used many times 2 CPU cores and 1 GB RAM if that is for testing very small things.

If you want to setup a bigger test deployment where you want to create scheduled searches, share the Splunk server with others and develop something then it would be better to use the minimum reqs on AWS.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...