Changing from RHEL to CoreOS for Splunk

[sathwikr076]

we are planning to change from RHEL to CoreOS. I don't have any experience on CoreOS. I need some inputs on this. Please let me know if anyone have experience on CoreOS for Splunk.

Thanks.

[codebuilder]

CoreOS is designed specifically for running containers. It could be an option if you are wanting to use the Splunk Docker images (though not officially supported), but not for running Splunk on physical hardware.

[sathwikr076]

Thanks for your reply.

[codebuilder]

Glad to help! Also worth noting, Red Hat recently acquired CoreOS. So if your goal is to move away from Red Hat (usually because of support pricing), you might want to look other options. Oracle Enterprise Linux is a good choice, and of course there are many others.

[sathwikr076]

i guess splunk is officially support for the docker image. please see the link below.

https://hub.docker.com/r/splunk/splunk

[codebuilder]

Yes, Splunk released an officially supported Docker image in v7.2. But that image does not use CoreOS as the underlying operating system.

[sathwikr076]

but the document says it will support any linux-based operating system. CoreOS is also linux but for containers, right?

[codebuilder]

I think you may be confusing the container/image OS with the platform OS.

The platform OS would be the server on which you are running Docker, while the container/image OS is the OS that actually runs inside the container.

Splunk supports running Docker on any (or most) versions of Linux with a Kernel version > 4.0 according to the documentation. But, the officially published Splunk Docker image is built on either Centos or Debian.

You can build your own image using another flavor of Linux (CoreOS e.g.) but I do not believe that is officially supported by Splunk.

https://github.com/splunk/docker-splunk/tree/develop/base