Getting Data In
Highlighted

How do I install Splunk indexer on minimal Linux distro?

Splunk Employee
Splunk Employee

We need to deploy Splunk with a very small audit footprint. We've tried to build a basic Linux distro but Splunk wouldn't run because of some missing Linux libraries.

We were wondering if there is a minimal requirements for Linux OS libraries, or a process for locking down a linux server to the most minimal libraries. We've noted the Splunk Hardening Standards (http://wiki.splunk.com/Community:DeployHardenedSplunk).

I've suggested using RedHat as a barebones distro, but from any barebones Linux, how should we go about installing the missing libraries (mostly found in splunk/lib/), opening ports 8000/8089, running 'source setSplunkEnv', activating DNS, etc? What's the minimal footprint for installing a 6.2.x indexer?

0 Karma
Highlighted

Re: How do I install Splunk indexer on minimal Linux distro?

Splunk Employee
Splunk Employee

DNS, Port access etc is at the OS level, so you would have to follow your own companies internal build restrictions / guidelines for this. The Splunk RPM's and tarballs should contain everything necessary to run Splunk without the need for additional library installation.

There are some TA's that will need some additional components installed, but if this is the case, it will be documented in the TA's installation guides.

Refer to : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/SystemRequirements#Unix_operating_sys... for more information.

View solution in original post

Highlighted

Re: How do I install Splunk indexer on minimal Linux distro?

Motivator

Splunk is largely self-contained. There should not be any libs missing from within the Splunk deployment itself. If there are, something went amiss during installation. The only specified requirement is the minimum kernel version for each release. Provided you have a network stack it shouldn't need much else.

0 Karma
Highlighted

Re: How do I install Splunk indexer on minimal Linux distro?

Splunk Employee
Splunk Employee

Great answers guys!
And FTW (for some happy new Splunkers), what is the absolute minimum agnostic Linux install for a hardened 6.2.x indexer?

0 Karma
Highlighted

Re: How do I install Splunk indexer on minimal Linux distro?

Splunk Employee
Splunk Employee

Again this goes back to organisational / personal preferences and guidelines for builds at the OS Level.. Splunk is just a software component.

For securing Splunk itself, following the Splunk best practices for securing your Splunk Enterprise environment is the best framework to follow : http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

0 Karma

Re: How do I install Splunk indexer on minimal Linux distro?

Splunk Employee
Splunk Employee

Here's that link that works:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

(The trailing period broke your link)

0 Karma
Highlighted

Re: How do I install Splunk indexer on minimal Linux distro?

Splunk Employee
Splunk Employee

Updated, thanks.

0 Karma