Getting Data In

How do I install Splunk indexer on minimal Linux distro?

dwolf_splunk
Splunk Employee
Splunk Employee

We need to deploy Splunk with a very small audit footprint. We've tried to build a basic Linux distro but Splunk wouldn't run because of some missing Linux libraries.

We were wondering if there is a minimal requirements for Linux OS libraries, or a process for locking down a linux server to the most minimal libraries. We've noted the Splunk Hardening Standards (http://wiki.splunk.com/Community:DeployHardenedSplunk).

I've suggested using RedHat as a barebones distro, but from any barebones Linux, how should we go about installing the missing libraries (mostly found in splunk/lib/), opening ports 8000/8089, running 'source setSplunkEnv', activating DNS, etc? What's the minimal footprint for installing a 6.2.x indexer?

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

DNS, Port access etc is at the OS level, so you would have to follow your own companies internal build restrictions / guidelines for this. The Splunk RPM's and tarballs should contain everything necessary to run Splunk without the need for additional library installation.

There are some TA's that will need some additional components installed, but if this is the case, it will be documented in the TA's installation guides.

Refer to : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/SystemRequirements#Unix_operating_sys... for more information.

View solution in original post

dwolf_splunk
Splunk Employee
Splunk Employee

Great answers guys!
And FTW (for some happy new Splunkers), what is the absolute minimum agnostic Linux install for a hardened 6.2.x indexer?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Again this goes back to organisational / personal preferences and guidelines for builds at the OS Level.. Splunk is just a software component.

For securing Splunk itself, following the Splunk best practices for securing your Splunk Enterprise environment is the best framework to follow : http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

0 Karma

adauria_splunk
Splunk Employee
Splunk Employee

Here's that link that works:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

(The trailing period broke your link)

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Updated, thanks.

0 Karma

grijhwani
Motivator

Splunk is largely self-contained. There should not be any libs missing from within the Splunk deployment itself. If there are, something went amiss during installation. The only specified requirement is the minimum kernel version for each release. Provided you have a network stack it shouldn't need much else.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

DNS, Port access etc is at the OS level, so you would have to follow your own companies internal build restrictions / guidelines for this. The Splunk RPM's and tarballs should contain everything necessary to run Splunk without the need for additional library installation.

There are some TA's that will need some additional components installed, but if this is the case, it will be documented in the TA's installation guides.

Refer to : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/SystemRequirements#Unix_operating_sys... for more information.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...