Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Is Splunk supported on Red Hat Enterprise Linux 7 ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The following document shows Linux, 3.0+ is supported.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Installation/Systemrequirements#Supported_OSes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Linux kernel 3.x and later (32-bit) was deprecated in 6.3 so you cannot upgrade to Splunk ver.6.3.x.
Note: Linux kernel 3.x and later (64-bit) should be supported in Splunk ver.6.3.x.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IF YOU HAVE RHEL7
ADD THE FOLLOWING "SLEEP 60" to your /etc/init.d/
#
Sleep 60
RETVAL=0
. /etc/init.d/functions
splunk_start() {
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please expand on why this is/was necessary? I realize this answer is quite old by now, but its always helpful to understand WHY something is recommended.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Macy, could you elaborate on this, please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Presumably the sleep delay allows PAM to be fully spun up so that ulimit settings are applied properly when Splunk starts. Another alternative and more details are discussed in George Starcher's blog post Splunk Ulimits and You.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The following document shows Linux, 3.0+ is supported.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Installation/Systemrequirements#Supported_OSes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, the doc refers to "3.0+". Does that mean 3.10 would be covered?
Also, anyone know why the /etc/init.d change above is recommended?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Latest doc lists 3.x covering 3.10
http://docs.splunk.com/Documentation/Splunk/6.4.2/Installation/Systemrequirements#Supported_OSes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great. Thank you.
-Joseph
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
