Friday, May 27, 2016

Splunk Standalone node installations

Splunk Standalone node installations

Environment Setup
·         Download Ubuntu Linux 12.04.3 LTS or CentOS 6.7 (Any linux flavor)
·         Download Latest Splunk Enterprise tar ball ( For simplicity)

Pre-requisites

·        Do the necessary network settings and assign static IP if preferred.
·        Assign the hostname in network and hosts files.
·        All hosts must be recent version of Linux x86_64 (kernel +2.6)
    - Python 2.7 must installed and present in PATH. Python 3 is NOT supported.
        - Additionally, the following Python modules must be installed:
            - pycrypto (needed by paramiko)
            - simplejson
            - pyyaml
        * These modules can usually be installed using 'pip'
    - sar must be installed on all systems.
        - needed for metrics
    - All hosts must be reachable from each other.
        - DNS must be working or, alternatively, host files must be working
    - All hosts must be running SSH.
        - Preferably, SSH keys should be exchanged to all
    - Time is synchronized on all hosts.
        - This is *extremely* important as many measurements depend on time
          accuracy.

Install python 2.7
Redhat now has "Software Collections" which take care of this sort of thing, so you can do:
yum install centos-release-SCL
yum install python27
Then if you want to use if in your shell you would run something like:
scl enable python27 bash
Which sets up the correct environment variables (including PATH and LD_LIBRARY_PATH etc) and dumps you into a new shell - pretty sure it would't be too hard to make that the default.....

Install pycrypto
yum install gmp-devel
pip install pycrypto

Install SimpleJson.
Install Pyyaml
Install sar
yum install syssstat

Above installations required only if you're building a solution to run Benchmark tools. 

Splunk Enterprice installation.
Untar the splunk tar ball to the /opt location (or any other preferred one)
[root@splunk_standalone sbk_files]# tar -zxvf splunk-6.3.1-f3e41e4b37b2-Linux-x86_64.tgz -C /opt

Go the /opt check the splunk folder created
[root@splunk_standalone opt]# ll
total 11936
-rw-r--r--.  1 root root  1522812 Mar  5 12:15 get-pip.py
drwxr-xr-x. 18 1000 1000     4096 Apr 14 21:38 Python-2.7.6
-rw-r--r--.  1 root root 10431288 Nov 10  2013 Python-2.7.6.tar.xz
drwxr-xr-x.  8 root root     4096 Apr 14 22:04 PyYAML-3.11
-rw-r--r--.  1 root root   248685 Mar 26  2014 PyYAML-3.11.tar.gz
drwxr-xr-x.  2 root root     4096 Mar 26  2015 rh
drwxr-xr-x.  8  506  506     4096 Oct 30  2015 splunk
[root@splunk_standalone opt]#

Check the files installed under Splunk directory.
[root@splunk_standalone opt]# cd splunk/
[root@splunk_standalone splunk]# ll
total 1796
drwxr-xr-x.  4 506 506    4096 Oct 30  2015 bin
-r--r--r--.  1 506 506      57 Oct 30  2015 copyright.txt
drwxr-xr-x. 14 506 506    4096 Oct 30  2015 etc
-rw-r--r--.  1 506 506       0 Oct 30  2015 ftr
drwxr-xr-x.  3 506 506    4096 Oct 30  2015 include
drwxr-xr-x.  6 506 506    4096 Oct 30  2015 lib
-r--r--r--.  1 506 506   62027 Oct 30  2015 license-eula.txt
drwxr-xr-x.  3 506 506    4096 Oct 30  2015 openssl
-r--r--r--.  1 506 506     509 Oct 30  2015 README-splunk.txt
drwxr-xr-x.  3 506 506    4096 Oct 30  2015 share
-r--r--r--.  1 506 506 1737206 Oct 30  2015 splunk-6.3.1-f3e41e4b37b2-linux-2.6-x86_64-manifest
[root@splunk_standalone splunk]#



Now start the splunk first time and accept the license
[root@splunk_standalone splunk]# ./bin/splunk start --accept-license

This appears to be your first time running this version of Splunk.
Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/etc/openldap/ldap.conf'.
Generating RSA private key, 1024 bit long modulus
..........................++++++
..++++++
e is 65537 (0x10001)
writing RSA key

Generating RSA private key, 1024 bit long modulus
...++++++
...........++++++
e is 65537 (0x10001)
writing RSA key

Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/opt/splunk/share/splunk/search_mrsparkle/modules'.

Splunk> CSI: Logfiles.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking appserver port [127.0.0.1:8065]: open
        Checking kvstore port [8191]: open
        Checking configuration...  Done.
                Creating: /opt/splunk/var/lib/splunk
                Creating: /opt/splunk/var/run/splunk
                Creating: /opt/splunk/var/run/splunk/appserver/i18n
                Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css
                Creating: /opt/splunk/var/run/splunk/upload
                Creating: /opt/splunk/var/spool/splunk
                Creating: /opt/splunk/var/spool/dirmoncache
                Creating: /opt/splunk/var/lib/splunk/authDb
                Creating: /opt/splunk/var/lib/splunk/hashDb
        Checking critical directories...        Done
        Checking indexes...
                Validated: _audit _internal _introspection _thefishbucket history main summary
        Done
New certs have been generated in '/opt/splunk/etc/auth'.
        Checking filesystem compatibility...  Done
        Checking conf files for problems...
        Done
        Checking default conf files for edits...
        Validating installed files against hashes from '/opt/splunk/splunk-6.3.1-f3e41e4b37b2-linux-2.6-x86_64-manifest'
        All installed files intact.
        Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Generating a 1024 bit RSA private key
...............................................................................................++++++
..............++++++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=splunk_standalone/O=SplunkUser
Getting CA Private Key
writing RSA key
Done
                                                           [  OK  ]

Waiting for web server at http://127.0.0.1:8000 to be available...... Done


If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://splunk_standalone:8000

Start the Splunk Web Interface at http://splunk_standalone:8000
First time when you open the page you’ll have to change the password, default is admin and changeme





Password can start be set in the backend in CLI
splunk edit user admin -password <New_Splunk_Admin_Password> -role admin -auth admin:changeme


  

Under SettingàSystemsàlicense change the license group to free license and you’re all set to go




Finally.
Added in bash profile file Splunkhome and bin in path.

Splunk start
Splunk restart
Splunk stop

Above will start both splunkd and splunkweb deamons.


No comments:

Post a Comment