Setting Up the Splunk Environment

To fully appreciate the capabilities of Splunk, we will set up a Splunk Enterprise deployment in this chapter. We will use Amazon Web Services (AWS) instances to deploy three forwarders, an indexer, a search head, and a deployment server. As we learned in Chapter 1, Introduction to Splunk and its Core Components, the indexer is the Splunk server responsible for the storage of the data in a format that is easily searchable. The search head is used to search the data by sending requests to the indexers. In addition, in this chapter, we will install a deployment server used to deploy configurations throughout the deployment. Remember that Splunk can be installed on a standalone server to run the case study, however, we are including this chapter to give you hands-on experience of installing and configuring Splunk. Understanding the different components and how they are set up will be very useful as we move through the rest of this chapter.

In this...