Splunk Search

Splunk Practice Environment

itsmevic
Communicator

I'd like to set up a practice Splunk environment so that I can practice various install methods of Splunk (clustering, distributed, standalone AIO, etc). I have chosen Linux as my OS build for all of my EC2 instances on AWS, but I am unsure if it would just be easier to set up a 4 or 5 instance environment (Monitoring Console, forwarder, 2 indexers, search head) in Virtualbox? In going that route I know I would need a crap-ton of memory and CPU on each virtual image in order to support Splunk min specs. I just need some good recommendations as to what is going to be the best environment to use in setting up a solid Splunk learning environment that I can practice in. Thanks for your help.

0 Karma

skalliger
SplunkTrust
SplunkTrust

The hardware requirements you're referring to has nothing to do with what can be set-up.
Splunk can be installed on almost any machine with a CPU, some RAM and free disk space (>= 5 GB, some other restrictions apply of course). For testing purposes, you don't have to meet the minimum HW requirements. That docs page lists just the minimum specs that are supported. You can run a SH on 2 vCPUs and 2 GB RAM. You won't have much fun though.

Skalli

0 Karma

gfreitas
Builder

If it is completely for you to practice and won't expect to be running any scheduled searches, modular inputs etc I don't see why not using Virtual Box. I have used many times VirtualBox with lots of servers and using small amount of memory and CPU. I used many times 2 CPU cores and 1 GB RAM if that is for testing very small things.

If you want to setup a bigger test deployment where you want to create scheduled searches, share the Splunk server with others and develop something then it would be better to use the minimum reqs on AWS.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...