topic Re: Is there a yum/rpm repo for Splunk? in Security

Is there a yum/rpm repo for Splunk?

stefanlasiewski — Wed, 09 Nov 2011 00:29:27 GMT

I'm installing Splunk on an Enterprise Linux 6.1 machine.

The Install on Linux instructions talk about a RPM, but don't explain where the RPM is.

A Yum/RPM repository would be helpful in terms of installation, updates and would speed up the deployment of security updates

This would also help with security updates. In our case Splunk doesn't always notify us that there is a security update available and Splunk security updates are not announced via email. If Splunk provided yum & apt repos, then checking for security update could be as simple as yum check-update splunk or yum upgrade splunk.

Does Splunk.com provide a Yum/RPM repository for the Splunk application?

Re: Is there a yum/rpm repo for Splunk?

gkanapathy — Wed, 09 Nov 2011 05:41:13 GMT

No, Splunk does not provide a yum/RPM repository. (No deb/apt repository either.) You can select your version of choice from: http://www.splunk.com/download (registration needed to download after you've selected your version).

On the target page for the selected download version, you will also find a link the to the MD5 for that version if you wish to verify the download, along with instructions for getting the file using wget instead of your browser.

Re: Is there a yum/rpm repo for Splunk?

yuvalba — Sun, 09 Jun 2013 16:43:37 GMT

Any update on this topic since it was asked at Nov '11?
I am also going to deploy Splunk forwarder on many servers and was wondering how to ensure it is being kept up to date with security updates etc?
Why not support the native Linux software management tools?

Re: Is there a yum/rpm repo for Splunk?

jherring_splunk — Wed, 07 Dec 2016 14:55:31 GMT

This could be a great way to keep eg forwarders up to date if not the search head/indexers.

Re: Is there a yum/rpm repo for Splunk?

timmy13 — Wed, 22 Mar 2017 13:44:57 GMT

This is a really old thread, but I wonder if there is an update. It would Splunk would have put a repo up by now.

Re: Is there a yum/rpm repo for Splunk?

Michael — Wed, 22 Mar 2017 14:17:06 GMT

No change, AFAIK.

Splunk engineers tell me the assumption is that people are using 3rd party products (i.e. Puppet). That's fine if you have staff to support that. But we're just a "medium" sized organization so I'm facing about 1,000 systems (and separate sys-admin groups all doing their own thing) to update manually (i.e. no Puppet). All because Splunk lawyers feel it's necessary for us to acknowledge the freakin' license agreement after every update. After seeing enough of their presentations with that retarded first slide they always put up ("Disclaimer...!") I'm not surprised. Do I sound bitter about this? 'cause I am...

Re: Is there a yum/rpm repo for Splunk?

amiracle — Wed, 22 Mar 2017 14:28:22 GMT

One of the reasons that I heard why Splunk does not have a public repo is that as a part of the Terms of Service under Exhibit A, line 17:

Customer certifies that Customer is not on any of the relevant U.S. government lists of prohibited persons, including the Treasury Department’s List of Specially Designated Nationals and the Commerce Department’s List of Denied Persons or Entity List.

This is done by accepting the terms of service when a user logs in and downloads the software.

The solution is that users can create their own Yum Repo's and update them using the cURL command listed in the Download page for each version. Once you've setup your own private repo, then you can run yum install splunkforwarder -y and install your forwarder.

Here are the steps to create your own Custom YUM repo:

Install "createrepo" yum install createrepo
Create Repo Directory mkdir /splunkrepo
Put RPM into Repo Directory Get this link from the Splunk Download page under Useful Tools Download via Command Line (wget) wget -O SPLUNK.RPM https://www.splunk.com/bin/splunk/DownloadActivityServlet? mv /path/to/rpm /splunkrepo
Run "createrepo" createrepo /splunkrepo
Create Repo config file
Example Repo File

[splunkrepo]
name=Splunk Software Repository
baseurl=file:///splunkrepo/
enabled=1
gpgcheck=0

* Digital Ocean How-To

Re: Is there a yum/rpm repo for Splunk?

kfiresmith — Wed, 22 Mar 2017 14:37:41 GMT

This only solves a minor part of the problem. People asking for a YUM repo mostly aren't asking because they want to install updates direct from a YUM repository, but because we want an easy sync source for our own pre-existing internal YUM repos that takes the human factor out of checking the main site by hand for updated packages, downloading them and re-publishing them internally. With Satellite or Pulp, all that would happen automatically based on pre-defined sync and publish rules.

Splunk is currently the ONLY vendor I have to do this archaic nonsense by hand with still. Everything else is synced automatically overnight into Satellite and pre-defined rules specify the workflow from there.

Re: Is there a yum/rpm repo for Splunk?

Michael — Wed, 22 Mar 2017 14:40:32 GMT

Oh, that makes me feel better, I'm sure that Exhibit A, line 17 has done wonders in protecting us from Enemies of the State. I understand accepting it once, but on every update? On the Forwarders? Please. I bet you heard that from one of their lawyers... 😉

On a lighter note:
We have a private repo, and it works great for everything including the forwarder updates. The problem is that when the Splunk process restarts, it prompts for the license agreement and asks if you want to migrate the database. Yes, I'm aware of the switches we can use, but this can't be automated without some kind of post-processing (script). The upshot is, if we drop a Splunk update in our repos, and folks run 'yum update' across their enclave -- their Splunk instances don't restart -- and the only indication to me is that I notice I haven't seen a bunch of systems reporting in after after a while. With NIST 800-171 breathing down our necks (end-point log monitoring), that's not good.

Are you implying that you've done this, and you don't have that problem?

thanks,
Mike

Re: Is there a yum/rpm repo for Splunk?

Michael — Wed, 22 Mar 2017 14:51:10 GMT

But, don't you feel safer knowing that Exhibit A, line 17 is protecting Freedom, Heros, and Apple Pie? 😉

Re: Is there a yum/rpm repo for Splunk?

amiracle — Wed, 22 Mar 2017 14:52:29 GMT

I've done this using automation tools such as Chef, Puppet and Ansible. I also use the tgz files instead of RPM's, more of a preference on my part. That is a more scalable solution since I can control the deployment and the orchestration of the update. I agree that a yum / apt repo would be nice to have and I've asked for it too.

Thanks,
Kam

Re: Is there a yum/rpm repo for Splunk?

halr9000 — Wed, 22 Mar 2017 15:18:34 GMT

We now have security announcements available via RSS feed. I'll mention this in the linked question also. See https://www.splunk.com/page/securityportal

Edit: I see that was already covered there.

Re: Is there a yum/rpm repo for Splunk?

kfiresmith — Wed, 22 Mar 2017 15:31:16 GMT

Sure but that's still treating Splunk content like a special snowflake. I just want to sync the damn rpms into our enterprise the way all the others happen. If even stuck-in-the-1990s Dell can manage, so can Splunk.

Re: Is there a yum/rpm repo for Splunk?

amiracle — Wed, 22 Mar 2017 23:23:40 GMT

Additionally, here is a blog post to help with using a repo server and installing splunk binaries: http://www.rfaircloth.com/2017/03/07/automating-splunk-deployment-redhatcentos-poor-mans-edition/

Re: Is there a yum/rpm repo for Splunk?

bishopolis — Mon, 04 Dec 2017 19:29:04 GMT

2 months later.

Have they published a proper repo yet?

A software repo with automatic updates is a tiny, tiny bit of what makes an 'Enterprise' company an Enterprise company, and it's valuable for so many reasons that we all should understand by now. Even if we're using Puppet (chef for us) to manage config, config management doesn't magically absolve sysadmins from the need to be adequate -- and installable artifacts (Hi BruceJackson) are best-practice for a very, very good reason.

I think everyone here wants Splunk to be awesome -- for some of us starting this journey, we've been told so many great things. I'm hoping they've published a repo and just forgotten to update this particular thread, so if anyone found one can you show me where I overlooked it?

Re: Is there a yum/rpm repo for Splunk?

amiracle — Tue, 05 Dec 2017 15:35:39 GMT

Still working on this internally. Hope to have a response soon.

Re: Is there a yum/rpm repo for Splunk?

bishopolis — Wed, 06 Dec 2017 00:15:37 GMT

Fantastic! But don't be teasing us, now 😉

Soon as you have info I'd love to hear it -- of course!

Re: Is there a yum/rpm repo for Splunk?

Intermediate — Mon, 29 Jan 2018 22:03:22 GMT

Do you have an update on this please?
It would save my team manual work every month at least (more for urgent security updates).

The lack of public repos is particularly frustrating for Debian/Ubuntu clients. This is because I will have to set up my own signed repository just to distribute packages which were already signed by Splunk.

It is not possible to just drop the Splunk-signed packages on my apt-mirror, I have to sign the repository itself (or used unsigned packages!)

At least Red-Hat based OSes only require basic repo (and it can be imported in to Satellite 6 easily)

Re: Is there a yum/rpm repo for Splunk?

bishopolis — Fri, 16 Mar 2018 22:25:14 GMT

3 months later (76 months overall). Any updates?

Right now, Splunk is considered Not Enterprise Capable due to the broken update stream.

"Day 2" problems are important in the Enterprise.

Re: Is there a yum/rpm repo for Splunk?

Intermediate — Mon, 07 May 2018 03:17:40 GMT

amiracle could you please provide us all an update? Even if your work didn't go anywhere it would be helpful to have closure.