Deployment Architecture

Splunk Distrubuted Deployment in my Local System

rakshithreddy
Explorer

Hi all,

I am trying to set up a small Splunk distributed deployment in my Local System.
with
3 Indexers
Master
1 Search Head
License Master ( Enterprise Trial 60 days License )

When I was trying to add the slaves to License Master, Its keep on getting this error -

Bad Request — In handler 'localslave': editTracker failed, reason='Unable to connect to license master:

Question:
Can I create a Distributed Setup using Enterprise Trial License?
can I request Splunk support for Trial License which can work with this setup?

Thank you

0 Karma
1 Solution

koshyk
Super Champion

I think, you are hitting some basic issues. So my suggestion is you to learn a bit more into making settings correctly and read the configs to setup a larger cluster system. Please find suggestions in order of preference
1. Get a developer license (10GB per day) with full license options. Its free.
2. Setup a standalone System with SH, IDX all in same machine with license . Check everything is working
3. Now create 4 indexers separately and use a Cluster Master
4. Now split license server outside and so on..
5. Finally make a SH cluster

If you don't want to have all the pain, Use docker. Best docker images are
1. Full blown Splunk-n-box => https://github.com/mhassan2/splunk-n-box
2. Simpler Docker Splunk => https://github.com/getkub/docker_splunk

You can then customise the docker setup to bring up all the cluster etc, rather than having individual installations in VM

View solution in original post

0 Karma

koshyk
Super Champion

I think, you are hitting some basic issues. So my suggestion is you to learn a bit more into making settings correctly and read the configs to setup a larger cluster system. Please find suggestions in order of preference
1. Get a developer license (10GB per day) with full license options. Its free.
2. Setup a standalone System with SH, IDX all in same machine with license . Check everything is working
3. Now create 4 indexers separately and use a Cluster Master
4. Now split license server outside and so on..
5. Finally make a SH cluster

If you don't want to have all the pain, Use docker. Best docker images are
1. Full blown Splunk-n-box => https://github.com/mhassan2/splunk-n-box
2. Simpler Docker Splunk => https://github.com/getkub/docker_splunk

You can then customise the docker setup to bring up all the cluster etc, rather than having individual installations in VM

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...