Custom installations...

[DTERM]

Based on the splunk documentation, I'm guessing it's recommended to script customized installation requirements rather than trying to generate a custom RPM. I'd like some feedback on that. If customizing RPM's is doable can you post a spec file for 4.2. I am aware there are spec files for older versions on the net, I'm specifically trying to work with 4.2. TIA.

[dwaddle · Accepted solution]

Our solution to this was to make our own rpm that is dependent upon the splunkforwarder RPM. Our RPM ships the appropriate config files to get a forwarder properly configured and talking to a deployment server.

Our RPM contains (relative to /opt/splunkforwarder)

etc/system/local/user-seed.conf
etc/system/local/server.conf
etc/system/local/deploymentclient.conf
etc/system/local/inputs.conf
etc/auth/server.pem
etc/auth/cacert.pem

There is a postinst script that goes along with it to enable boot-start and start splunk for the first time.

The most elegant part of this is that an upgrade to the base Splunk RPM won't replace any of these. I would recommend this approach over trying to spin your own Splunk RPM.