Create a Splunk Phantom Cluster from an OVA installation
Converting a Splunk Phantom virtual machine to a server or cluster node is a one-way operation. It cannot be reverted.
The most basic version of a Splunk Phantom cluster is a single Shared Services server connected to multiple instances of Splunk Phantom.
This configuration is not recommended for production use. This mode is primarily intended for Proof of Value or demonstrations. A single Shared Services server becomes a single point of failure. Any problems on the Shared Services server impact your entire Splunk Phantom cluster.
Use the following checklist for a Single Shared Services server
|1||Create the Shared Services server.||
|2||Install Splunk Phantom cluster nodes.|
Build a cluster with external service services
Build a more robust cluster, putting each of the services on its own server or group of servers to serve multiple cluster nodes of Splunk Phantom.
Use the following checklist for a virtual machine images cluster with external services
|1||Create the HAProxy node.||
|2||Create the PostgreSQL node.||
|3||Create the file shares node||
|4||Create the Splunk Enterprise node||
|5||Install Splunk Phantom cluster nodes.|
About Splunk Phantom clusters
Create a Splunk Phantom cluster from an RPM or TAR file installation
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7