Getting Data In

How do I install Splunk indexer on minimal Linux distro?

dwolf_splunk
Splunk Employee
Splunk Employee

We need to deploy Splunk with a very small audit footprint. We've tried to build a basic Linux distro but Splunk wouldn't run because of some missing Linux libraries.

We were wondering if there is a minimal requirements for Linux OS libraries, or a process for locking down a linux server to the most minimal libraries. We've noted the Splunk Hardening Standards (http://wiki.splunk.com/Community:DeployHardenedSplunk).

I've suggested using RedHat as a barebones distro, but from any barebones Linux, how should we go about installing the missing libraries (mostly found in splunk/lib/), opening ports 8000/8089, running 'source setSplunkEnv', activating DNS, etc? What's the minimal footprint for installing a 6.2.x indexer?

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

DNS, Port access etc is at the OS level, so you would have to follow your own companies internal build restrictions / guidelines for this. The Splunk RPM's and tarballs should contain everything necessary to run Splunk without the need for additional library installation.

There are some TA's that will need some additional components installed, but if this is the case, it will be documented in the TA's installation guides.

Refer to : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/SystemRequirements#Unix_operating_sys... for more information.

View solution in original post

dwolf_splunk
Splunk Employee
Splunk Employee

Great answers guys!
And FTW (for some happy new Splunkers), what is the absolute minimum agnostic Linux install for a hardened 6.2.x indexer?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Again this goes back to organisational / personal preferences and guidelines for builds at the OS Level.. Splunk is just a software component.

For securing Splunk itself, following the Splunk best practices for securing your Splunk Enterprise environment is the best framework to follow : http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

0 Karma

adauria_splunk
Splunk Employee
Splunk Employee

Here's that link that works:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

(The trailing period broke your link)

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Updated, thanks.

0 Karma

grijhwani
Motivator

Splunk is largely self-contained. There should not be any libs missing from within the Splunk deployment itself. If there are, something went amiss during installation. The only specified requirement is the minimum kernel version for each release. Provided you have a network stack it shouldn't need much else.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

DNS, Port access etc is at the OS level, so you would have to follow your own companies internal build restrictions / guidelines for this. The Splunk RPM's and tarballs should contain everything necessary to run Splunk without the need for additional library installation.

There are some TA's that will need some additional components installed, but if this is the case, it will be documented in the TA's installation guides.

Refer to : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/SystemRequirements#Unix_operating_sys... for more information.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!