What are the requirements for a minimal Splunk installation on Ubuntu 20.04?

[danielbb]

We are creating an installation of one indexer, one search head, and one universal forwarder with syslog, and I wonder what the minimal OS requirements are--such as disabling transparent huge pages on the indexer, file descriptors, etc. we are speaking about a bare minimum installation.

[kiran_panchavat]

@danielbb default ulimit value is 1024. Minimal values might work for basic setups, but modern applications often require higher limits.

[kiran_panchavat]

@danielbb You can put the ulimit value 65535.

[kiran_panchavat]

@danielbb 

Please have a look

https://docs.splunk.com/Documentation/Splunk/9.4.0/Installation/SystemRequirements#Considerations_re... 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

[kiran_panchavat]

@danielbb 

This allows different buckets to be stored on different storage types which can in turn is very useful to improve efficiency and reduce storage costs. Below are the recommended configurations for each bucket/storage type and example indexes.conf parameters that can be utilized .

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

[kiran_panchavat]

@danielbb 

General Considerations for all Splunk servers

1.Setting Ulimits and Transparent Huge Pages
2.Turn OFF SELInux
3.Check the Firewalld – In case as per company policy you need to have OS-level firewall make sure you open the required ports for Splunk on the OS. Following are a few useful commands you can use
4.Don’t Run Splunk as Root, Create a Splunk user & group, Give Splunk user Sudo privileges.

5.Storage Consideration for Indexers

Splunk indexed data goes through various stages during its lifecycle as shown below:

Hot Bucket > Warm Bucket > Cold Bucket > Frozen/Archived > Thawed(Manual process)

This allows different buckets to be stored on different storage types which can in turn is very useful to improve efficiency and reduce storage costs. 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

[danielbb]

Thanks @kiran_panchavat,

About the ulimits, what are the minimal ulimits requirements?

[kiran_panchavat]

@danielbb Go through this link for more information : https://www.splunk.com/en_us/blog/tips-and-tricks/whats-your-ulimit.html 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.