Splunk® Phantom (Legacy)

Install and Upgrade Splunk Phantom

Install Splunk Phantom as a virtual machine image

Splunk Phantom is delivered as a virtual machine image in .OVA format.

With the release of Splunk Phantom 4.10, the virtual machine image of Splunk Phantom is for an unprivileged installation, meaning the the application runs under the phantom user account, not as the root user.

  • The base installation directory for the unprivileged virtual machine is /opt/phantom/. All Splunk Phantom files and logs will be located under this directory. For example, log files are in /opt/phantom/var/log/phantom. In the instructions for installing a virtual machine image, <PHANTOM_HOME> represents the /opt/phantom/ directory.
  • The user account phantom owns the the Splunk Phantom install, and should be used to do all Splunk Phantom operations.
  • The custom HTTPS port is 9999, but the Splunk Phantom UI is also available on port 443.

Download the virtual machine image from the Splunk Phantom Community site on the Products page.

For evaluation or test environments, use a hypervisor or virtual machine management application such as VMware Fusion®, VMware Fusion Pro®, VMware Workstation Player®, VMware Workstation Pro®, or Oracle® VirtualBox.

For production environments, use VMware ESXi™ or VMware vSphere® version 5 or higher.

Install Splunk Phantom with VMware vSphere ESXi or VMware vSphere

These instructions might not be an exact match for the way your VMware vSphere or ESXi products configured. Consult your vSphere administrator or the documentation on the VMware website for more options.

You can use thin provisioning and install VMware Tools with Splunk Phantom.

  1. Log in to the correct vSphere or vCenter asset.
  2. From the File menu, select Deploy OVF Template.
  3. Click Browse to locate the downloaded OVA file.
  4. Click Next.
  5. Fill out the remaining settings options. Consult the VMware documentation on the VMware website or your VMware administrator.
  6. Click Finish.

Install Splunk Phantom with VMware Fusion® or VMware Fusion Pro®

For more detailed information on installing virtual machine images, consult the VMware Fusion or VMware Fusion Pro documentation.

  1. Open VMware Fusion or VMware Fusion Pro.
  2. From the File menu, select New.
  3. Click More options.
  4. Click Import an existing virtual machine.
  5. Click Choose File. Navigate to the Splunk Phantom OVA file.
  6. Click Open.
  7. Follow the remaining prompts to launch the virtual appliance.

Install Splunk Phantom with VMware Workstation Pro®

For more detailed information on installing virtual machine images, consult the VMware Workstation Pro documentation.

  1. Open VMware Workstation Pro.
  2. Click Open a Virtual Machine.
  3. Navigate to the Splunk Phantom OVA file.
  4. Click Open.
  5. Type a name and storage path for the virtual appliance.
  6. Click Import.
  7. Click Power on this virtual machine.

Install Splunk Phantom with VMware Workstation Player®

For more detailed information on installing virtual machine images, consult the VMware Workstation Player documentation.

  1. Open VMware Workstation Player.
  2. Click Open a Virtual Machine.
  3. Navigate to the Splunk Phantom OVA file.
  4. Click Open.
  5. Type a name and storage path for the virtual appliance.
  6. Click Import.
  7. Click Play virtual machine.

If you are prompted to connect additional devices, such as sound cards or USB ports to the virtual machine, decline. These devices are not required to run Splunk Phantom.

Install Splunk Phantom with Oracle® VirtualBox

For more detailed information on using Oracle VirtualBox to run virtual machine images, consult the VirtualBox end-user documentation on VirtualBox.org.

  1. Start Oracle VirtualBox.
  2. From the File menu, select Import Appliance.
  3. Select the folder icon to navigate to the Splunk Phantom OVA.
  4. Click Open.
  5. Click Continue.
  6. Click base_vm_centos_7.
  7. Click Start.

Complete the Splunk Phantom OVA install

These steps must be completed after the Splunk Phantom virtual appliance has been installed in your virtual machine manager. Splunk Phantom will generate a self-signed SSL certificate when it launches for the first time.


Set system passwords

You must set a new password for the user account phantom. The user account phantom has SSH and sudo permissions.

  1. SSH to the Splunk Phantom instance's operating system with the user account phantom. The default password is 'password', and it must be changed immediately.
  2. Set a new password for the phantom user account using the command passwd phantom.

More information about passwords and user accounts:

  • SSH is disabled for the root user.
  • The password for the root user has been set to a randomly generated string. If you want to set the password to a known value, use the phantom user account, and run the command sudo passwd root.
  • You may remove sudo access from the phantom user account. If you choose to do that, you must create another user account that has NOPASSWD sudo access.

Configure the network settings for the virtual machine

The Splunk Phantom virtual machine requires a static IP address for production environments. In a test environment, you can use DHCP.

  1. SSH to the Splunk Phantom instance with the user account phantom.
    ssh phantom@<Splunk Phantom hostname or IP address>
  2. Elevate to root.
    sudo su -
  3. Edit the /etc/sysconfig/network-scripts/ifcfg-ens160 file. The file has these default settings:
    TYPE=Ethernet
    ONBOOT=yes
    BOOTPROTO=dhcp
    NM_CONTROLLED=NO
    DEVICE=ens160
    Change BOOTPROTO and add entries for IPADDR, NETMASK, and GATEWAY. Your finished file looks something like this:
    TYPE=Ethernet
    ONBOOT=yes
    BOOTPROTO=static
    NM_CONTROLLED=NO
    DEVICE=ens160
    IPADDR=<static_ip>
    NETMASK=<netmask>
    GATEWAY=<gateway>
  4. Add name servers to your network configuration in /etc/resolv.conf.
    echo "nameserver <nameserver_ip>" >> /etc/resolv.conf
  5. Restart networking on the virtual machine.
    systemctl restart network

The custom HTTPS port for unprivileged OVA or AMI based installations is TCP port 9999. However, the UI is still accessible on TCP port 443.

Next step: log in to verify the installation

You can log in to the Splunk Phantom web interface after the setup script completes to configure user accounts and additional settings. See Log in to the Splunk Phantom web interface.

Last modified on 24 January, 2023
Install Splunk Phantom using the Amazon Marketplace Image   Install Splunk Phantom to an existing server with RPM

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters