Blog

Continuing the series of Splunk Cluster setup articles with instructions on Installation and Setup of Ubuntu Linux for Splunk Cluster setup.

Contents:

• Setup VMWare Virtual Machine (Azure services)
• Install and Setup Ubuntu Linux (Azure services)
• Install and Setup Splunk
• Indexes Configuration
• Enable Clustering
• Add second Splunk instance to the cluster
• * Potential problems
• Add third Splunk instance to the cluster (Search Head)

Details:

Installing and setting up Splunk is pretty straightforward, but you need Splunk.com account and subscription/license. You can download trial version of Splunk Enterprise which will give you 60 days to test drive it and index 500MB of data daily. After 60 days you would have to either downgrade to Free license, which doesn’t give you clustering capabilities, or purchase full license. More info…

1. Go ahead and create Splunk.com account and download latest version of Splunk kernel Linux distributions 32 or 64 bit depending on your configurations, but make sure you download .deb package.
2. Once downloaded, Open Terminal and run replacing filename with proper name

   sudo dpkg -i splunk-6.X.X-XXXX-linux-2.6-amd64.deb

3. Once package installation is complete, navigate to /opt/splunk/bin folder

   cd /opt/splunk/bin

4. And start Splunk for the first time

   sudo ./splunk start --accept-license

5. Once Splunk starts, you will see confirmation:

   The Splunk web interface is at http://splunk1:8000

6. Enable Splunk auto-start on boot:

   sudo /opt/splunk/bin/splunk enable boot-start

7. That’s it! Let’s login to Splunk web interface by navigating to http://10.121.1.21:8000 replace IP address with yours (get it by running ifconfig)
8. When you login for the first time, you are asked to change your password, do that.
9. When logged in, you might get message about free disk space. Remember, our VM had only 10GB of disk space, 4.5GB of which took OS.
10. Let’s suppress those warnings by adjusting settings in System Settings, General Settings.
11. Here you can change Splunk server name, adjust ports etc. But for now lets just change setting at the very bottom of the page: Pause indexing if free disk space (in MB) falls below* Change it to let’s say 500. We can adjust it in production environment later.
12. Once saved, you will need to restart Splunk:
13. And that’s it! We are ready to setup our cluster.