Getting Data In

Single Search Head and Indexer Configuration Help

qazwsxedc994
Explorer

I am looking to configure a single search head and indexer for testing purposes, however i cant seem to find any clear documentation to help me as everything seems to be related to clusters. How do i go about configuring single instances? What do i use a master_uri?

0 Karma

laserval
Communicator

What you're looking for is covered mostly in the Distributed Search documentation: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration

Here's a setup with a single search head and a single indexer:

  1. Install Splunk on each machine
  2. Indexer: Enable receiving
  3. Search Head: Enable forwarding of all data (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata)
  4. Search Head: Add the indexer as a search peer (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuredistributedsearch)
  5. Indexer: Configure as license slave to the Search Head (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurealicenseslave)

You can also disable the ui on the indexer, to make sure that you always search from the search head.

I also like setting up the search head as a deployment server, that deploys the configuration for the indexer. That way you get a single machine to find all the configuration on.

Note that you will have to create indexes on the indexer, not via the search head UI. There is more info in the documentation on distributed search and what it means for administration of Splunk.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...