Getting Data In

How do I run a universal forwarder on an indexer that's handling non-IT data?

gpullis
Communicator

I need to create a standalone Splunk instance to handle health data (about the health of humans. Non-IT data).

So, I want to forward its /var/log/* data to my main indexer like any other server.

Is there a way to have a universal forwarder and an unrelated indexer living on the same server? What are the caveats in setting that up?

0 Karma

ddrillic
Ultra Champion

You should probably be fine with one Splunk instance. Licensing-wise, you can segregate it via license pooling, which was built exactly for such a use case.

0 Karma

gpullis
Communicator

So, I would stand up a second indexer, connect it to my first indexer, and have my health data go to the second indexer and all my IT data go to the first indexer?

But then I'm centrally managing everything?

And either indexer could be used as a search head for all the data? And, when it comes time to separate my search heads and indexers my new search heads would be searching across both indexers?

As you can see, we haven't scaled beyond a single Splunk indexer / search head yet. But, am I getting the general principle right?

0 Karma

gfreitas
Builder

Yes, you can have two splunk instances on the same machine (just change the ports). But you can have both data on the same Splunk, two different Indexes (not indexers) and two access profiles for your users: IT person have access to IT Index and doctors have access to health Index.

0 Karma

gpullis
Communicator

Thanks. I'll try to install an indexer on the same machine as a configured forwarder and see how it goes.

We wanted to separate them because we're certain we'll never need to correlate their data with ours and we didn't want their work to impact the licensing or performance of our Splunk deployment.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...