Splunk Enterprise Standalone installation on OCP via Splunk Operator
- Download the splunk operator YAML, or use the one in this repo
wget -O splunk-operator-cluster.yaml https://github.com/splunk/splunk-operator/releases/download/2.5.2/splunk-operator-cluster.yaml
- Deploy the operator
oc create -f splunk-operator-cluster.yaml
- Allow the SA for the Splunk Operator to use the 'nonroot-v2' and 'anyuid' SCC
oc -n splunk-operator adm policy add-scc-to-user nonroot-v2 -z splunk-operator-controller-manager
oc -n splunk-operator adm policy add-scc-to-user anyuid -z splunk-operator-controller-manager
-
wait until the operator is running
-
Deploy a standalone instance
oc create namespace splunk
oc -n splunk adm policy add-scc-to-user nonroot-v2 -z default
oc -n splunk create -f enterprisesplunk.yaml
- expose the Splunk web UI
oc -n splunk expose svc splunk-s1-standalone-service
- get the admin password for the Splunk web UI
oc -n splunk get secret splunk-splunk-secret -o json | jq -r '.data.password' | base64 -d
- To connect ACS to Splunk where both ACS Central and Splunk are in the same OpenShift cluster, you'll need to take two steps:
- Log in to the Splunk UI, and navigate to the Data Inputs in the top right. Find the HTTP Event Collector (HEC). You'll need the token value from the HEC page.
- In ACS, you'll need to create an integration for Splunk from the Platform Configuration -> Integrations menu. You'll need the HTTP Event collector token. For the endpoint, use the HTTP Event Collector destination, and note that the port (:8088) is required:
https://splunk-s1-standalone-service.splunk.svc:8088/services/collector/event
- To connect ACS Central to Splunk running in a different OpenShift cluster, you'll need to expose Splunk using a Route
- An example Route is provided in the file hec-route.yaml
oc -n splunk create -f hec-route.yaml to create the Route
- To create an integration in ACS, you'll need the Splunk HEC, and the hostname from the Route:
oc -n splunk get route splunk-hec to see the Route hostname which should have the form:
https://splunk-hec-splunk.apps.cluster.example.com
- Note that in the ACS integration you do not need the port number since the Route is listening on port 443.