Use this guide for setting up Splunk Enterprise on CentOS7. I use the minimal CD for installing CentOS7.
Check the current hostname
# hostnamectl statusSet the hostname
# hostnamectl set-hostname splunk.server.localVerify the hostname change
# hostnamectl statusLog out and log back in to ensure the hostname is displaying correctly.
Configure NTP on the server.
# yum install -y ntp ntpdateEdit the NTP configuration file. Replace the current NTP server addresses with localised Australian servers or the closest NTP server to your host.
# vi /etc/ntp.conf
server 0.au.pool.ntp.org
server 1.au.pool.ntp.org
server 2.au.pool.ntp.org
server 3.au.pool.ntp.orgTurn on the NTP daemon.
# systemctl start ntpd
# systemctl enable ntpd.serviceCheck the status of the NTP daemon
# systemctl status ntpdUpdate the time at the command line if the NTP daemon has yet to be started.
# ntpdate 0.au.pool.ntp.orgInstalling tzdata.noarch through yum will install the latest version.
yum install -y tzdata.noarchYou should also check to make sure that the /etc/localtime link is pointing to a valid time zone. To do that, run the following command:
ls -altrh /etc/localtimeYou should get a response similar to this (below), where <ZONE> is your time zone such as:
lrwxrwxrwx. 1 root root 39 Jan 19 15:57 /etc/localtime -> /usr/share/zoneinfo/Australia/MelbourneIf this is not correct, run the following commands as user root:
# source /etc/sysconfig/clock
# mv /etc/localtime /etc/localtime.old
# ln -s /usr/share/zoneinfo/Australia/Melbourne /etc/localtime
# ls -altrh /etc/localtimeUsually, the default file descriptor limit (controlled by the ulimit -n command on a *nix-based OS) is 1024. Your Splunk administrator should determine the correct level. View the current settings with:
# umlimit -aI have seen the values change with different versions of Splunk so ensure you read Splunks documentation to ensure you have the correct minimum values.
Source: http://docs.splunk.com/Documentation/Splunk/7.1.2/Installation/SystemrequirementsO
n the default version of CentOS 7 I need to change the Open Files and User Processes.
# vi /etc/security/limits.conf
* soft nproc 16000
* hard nproc 16000
* soft nofile 64000
* hard nofile 64000$ sudo yum update -y# groupadd splunk
# useradd -c splunk_software_owner -g splunk -d /home/splunk -m -s /bin/bash splunk
# passwd splunk
# gpasswd -a splunk wheelThe default installation directory is /opt/splunk/.Make sure that the user splunk has write and execute permission for the /opt/splunk/ directory. Change the owner and group of /opt/splunk/ to the splunk user and group by issuing the following commands while logged in as root:
# mkdir /opt/splunk
# chown splunk:splunk /opt/splunkLogon to the server as the splunk user and add execute the following:Verify the binary's hash.
[splunk@splunk ~]$ sudo yum install -y wget
[splunk@splunk ~]$ openssl dgst -md5 <filename-splunk-downloaded.zip>or
[splunk@splunk ~]$ openssl dgst -sha512 <filename-splunk-downloaded.zip>
[splunk@splunk ~]$ chmod 744 splunk-*.rpm
[splunk@splunk ~]$ sudo rpm -i splunk-*.rpm
[splunk@splunk bin]$ sudo -H -u splunk /opt/splunk/bin/splunk start --accept-licenseAllow web access on port tcp 8000, syslog on udp 5514
# firewall-cmd --zone=public --permanent --add-port=8000/tcp
# firewall-cmd --zone=public --permanent --add-port=5514/udpForward syslog input to high port for non-root, allow port 80 for http
# firewall-cmd --direct --permanent --add-rule ipv4 nat PREROUTING 0 -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514
# firewall-cmd --direct --permanent --add-rule ipv4 nat PREROUTING 0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8000Reload firewall
# firewall-cmd --reloadU/N: admin