Archive

Changing from RHEL to CoreOS for Splunk

Communicator

we are planning to change from RHEL to CoreOS. I don't have any experience on CoreOS. I need some inputs on this. Please let me know if anyone have experience on CoreOS for Splunk.

Thanks.

0 Karma

Motivator

CoreOS is designed specifically for running containers. It could be an option if you are wanting to use the Splunk Docker images (though not officially supported), but not for running Splunk on physical hardware.

Communicator

Thanks for your reply.

0 Karma

Motivator

Glad to help! Also worth noting, Red Hat recently acquired CoreOS. So if your goal is to move away from Red Hat (usually because of support pricing), you might want to look other options. Oracle Enterprise Linux is a good choice, and of course there are many others.

0 Karma

Communicator

i guess splunk is officially support for the docker image. please see the link below.

https://hub.docker.com/r/splunk/splunk

0 Karma

Motivator

Yes, Splunk released an officially supported Docker image in v7.2. But that image does not use CoreOS as the underlying operating system.

0 Karma

Communicator

but the document says it will support any linux-based operating system. CoreOS is also linux but for containers, right?

0 Karma

Motivator

I think you may be confusing the container/image OS with the platform OS.

The platform OS would be the server on which you are running Docker, while the container/image OS is the OS that actually runs inside the container.

Splunk supports running Docker on any (or most) versions of Linux with a Kernel version > 4.0 according to the documentation. But, the officially published Splunk Docker image is built on either Centos or Debian.

You can build your own image using another flavor of Linux (CoreOS e.g.) but I do not believe that is officially supported by Splunk.

https://github.com/splunk/docker-splunk/tree/develop/base

0 Karma