topic Splunk RPM in Splunk Enterprise

Splunk RPM

ayushkmr08 — Wed, 25 Aug 2021 12:51:13 GMT

Hi,
We are using Splunk RPM package for installing splunk but before installing it we want to add some file to that package and repack it as RPM and then use it to install on other machines.

Anybody please help me on that ..

Thanks In Advance

Re: Splunk RPM

codebuilder — Wed, 25 Aug 2021 13:51:34 GMT

You can download the tarball and extract it, add your files, then re-build that as an RPM. The catch will be that your "new" RPM won't pass the hash checking by yum or dnf so you would have to override that.

Re: Splunk RPM

ayushkmr08 — Wed, 25 Aug 2021 15:14:13 GMT

@codebuilder Can you please elaborate the process. I am able to extract the RPM package but not sure how to rebuild or repack it as RPM

Re: Splunk RPM

ephemeric — Wed, 25 Aug 2021 17:39:38 GMT

May we know what file this is? I would recommend against unpacking and repacking the rpm as pointed out.

One can build a rpm but the process is complicated and *.spec files are convoluted at best.

If I know the file you wish to include, which should be deployed via some other mechanism like Ansible, Chef, Puppet, I can offer advice.

You can do a script with the rpm inline as an option.

Re: Splunk RPM

ephemeric — Wed, 25 Aug 2021 17:43:12 GMT

Sounds like https://en.wikipedia.org/wiki/XY_problem

Re: Splunk RPM

codebuilder — Wed, 25 Aug 2021 21:12:19 GMT

You would use rpmbuild to create a new package, but what are exactly are you trying to accomplish?
There's likely a much easier solution than trying to re-package Splunk.