VM templating of Splunk instances

takaakinakajima — Tue, 03 Oct 2017 04:19:46 GMT

We plan to create Splunk pre-installed virtual machine (VM)
templates for internal use.

We have assumed the following points should be taken steps
with Splunk VM templates.

Use hostname or FQDN in conf files instead of IP address directory.
Separate credentials and apply them after VM instantiation. default auth method, SSL/TLS certs, keys for clustering (e.g. pass4SymmKey)
Allocate enough (dedicated) resources for VMs.
https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

Does someone have any other ideas or points to notine for VM templates?

In a view point of DevOps, templates should be minimize like pure-OS,
Splunk or other applications should be installed and configured
via provisioning tools (Ansible, Chef, Puppet, Salt Stack, ...)
after launch of VMs.

Re: VM templating of Splunk instances

sdvorak_splunk — Tue, 03 Oct 2017 21:36:42 GMT

I assume you will take care of the OS level stuff as well:
ulimits
Turn off THP

Otherwise, looks relatively solid.

Re: VM templating of Splunk instances

takaakinakajima — Thu, 05 Oct 2017 00:53:30 GMT

Thank you @sdvorak.

I agree with you. OS tuning is important, especially for production.

topic Re: VM templating of Splunk instances in Getting Data In

VM templating of Splunk instances

Re: VM templating of Splunk instances

Re: VM templating of Splunk instances