VM templating of Splunk instances

[takaakinakajima]

We plan to create Splunk pre-installed virtual machine (VM)
templates for internal use.

We have assumed the following points should be taken steps
with Splunk VM templates.

• Use hostname or FQDN in conf files instead of IP address directory.
• Separate credentials and apply them after VM instantiation. default auth method, SSL/TLS certs, keys for clustering (e.g. pass4SymmKey)
• Allocate enough (dedicated) resources for VMs.
  https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

Does someone have any other ideas or points to notine for VM templates?

In a view point of DevOps, templates should be minimize like pure-OS,
Splunk or other applications should be installed and configured
via provisioning tools (Ansible, Chef, Puppet, Salt Stack, ...)
after launch of VMs.

[sdvorak_splunk · Accepted solution]

I assume you will take care of the OS level stuff as well:
ulimits
Turn off THP

Otherwise, looks relatively solid.

[takaakinakajima]

Thank you @sdvorak.

I agree with you. OS tuning is important, especially for production.