How do I install Splunk indexer on minimal Linux distro?

[dwolf_splunk]

We need to deploy Splunk with a very small audit footprint. We've tried to build a basic Linux distro but Splunk wouldn't run because of some missing Linux libraries.

We were wondering if there is a minimal requirements for Linux OS libraries, or a process for locking down a linux server to the most minimal libraries. We've noted the Splunk Hardening Standards (http://wiki.splunk.com/Community:DeployHardenedSplunk).

I've suggested using RedHat as a barebones distro, but from any barebones Linux, how should we go about installing the missing libraries (mostly found in splunk/lib/), opening ports 8000/8089, running 'source setSplunkEnv', activating DNS, etc? What's the minimal footprint for installing a 6.2.x indexer?

[dwolf_splunk]

Great answers guys!
And FTW (for some happy new Splunkers), what is the absolute minimum agnostic Linux install for a hardened 6.2.x indexer?

[esix_splunk]

Again this goes back to organisational / personal preferences and guidelines for builds at the OS Level.. Splunk is just a software component.

For securing Splunk itself, following the Splunk best practices for securing your Splunk Enterprise environment is the best framework to follow : http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

[adauria_splunk]

Here's that link that works:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/WhatyoucansecurewithSplunk

(The trailing period broke your link)

[esix_splunk]

Updated, thanks.

[grijhwani]

Splunk is largely self-contained. There should not be any libs missing from within the Splunk deployment itself. If there are, something went amiss during installation. The only specified requirement is the minimum kernel version for each release. Provided you have a network stack it shouldn't need much else.

[esix_splunk · Accepted solution]

DNS, Port access etc is at the OS level, so you would have to follow your own companies internal build restrictions / guidelines for this. The Splunk RPM's and tarballs should contain everything necessary to run Splunk without the need for additional library installation.

There are some TA's that will need some additional components installed, but if this is the case, it will be documented in the TA's installation guides.

Refer to : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/SystemRequirements#Unix_operating_sys... for more information.