Installation

Do every node needs to install Splunk enetrprise?

pratibha2018
Explorer

I have installed Splunk UF to each and every node and Splunk to a single node. Do I need to install Splunk enterprise to all the nodes/host having same port number?
If No, then is there any doc which will give a quick demo ??

Many Thanks

Tags (1)
0 Karma
1 Solution

deepashri_123
Motivator

Hi pratibha,
What do you mean by node in this case.? If you have a single-instance setup in that case,you need to install Splunk universal forwarder on host from which data has to be monitored and Splunk Enterprise on your splunk server.
You can refer docs below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchTutorial/InstallSplunk
http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder
Hope this helps!!!

View solution in original post

0 Karma

deepashri_123
Motivator

Hi pratibha,
What do you mean by node in this case.? If you have a single-instance setup in that case,you need to install Splunk universal forwarder on host from which data has to be monitored and Splunk Enterprise on your splunk server.
You can refer docs below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchTutorial/InstallSplunk
http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder
Hope this helps!!!

0 Karma

pratibha2018
Explorer

Thanks Deepshri for answering this but I am too confused with the following:

Do I monitor the logs of various host IDs with a splunk enterprise installed only on one of the host id and splunk UF on all of them?

0 Karma

deepashri_123
Motivator

Yes , and you need to add the path in inputs.conf on forwarder to monitor the logs you need to index in splunk.
Also you need to enable outputs.conf on forwarder and enable receiving on indexer.
You also need to create index in indexes.conf on splunk instance.

Refer the link:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Getstartedwithgettingdatain

Let me know if this helps!!

0 Karma

pratibha2018
Explorer

This is helpful.

Many thanks Deepashri 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...