Setting up Splunk indexers

We already configured our forwarders to send data to the indexer. Now, we need to ensure that the indexer is listening for the forwarded data. We will use a series of CLI commands to accomplish this in this section. Follow these steps:

1. Log in to your indexer using an SSH client. Refer to step 1 of the Setting up Splunk Deployment Servers section for information on logging in to SSH. Enter yes to the authenticity prompt:

   ssh -i "<your private key>.pem" ec2-user@<your EC2 Instance name or IPv4>

2. Use the sudo command to change from ec2-user to the splunk user:

   sudo -i -u splunk

Use the following command to check that Splunk is running:

/opt/splunk/bin/splunk status

3. We will start by changing the hostname and servername, as we did for the forwarders and deployment server. Use the following command to change the default-hostname and servername values:

   /opt/splunk/bin/splunk set servername indexer

   /opt/splunk/bin/splunk...