Create a Splunk Phantom Cluster from an OVA installation

Converting a Splunk Phantom virtual machine to a server or cluster node is a one-way operation. It cannot be reverted.

Build a cluster with a single Shared Services server

The most basic version of a Splunk Phantom cluster is a single Shared Services server connected to multiple instances of Splunk Phantom.

This configuration is not recommended for production use. This mode is primarily intended for Proof of Value or demonstrations. A single Shared Services server becomes a single point of failure. Any problems on the Shared Services server impact your entire Splunk Phantom cluster.

Use the following checklist for a Single Shared Services server

Number	Task	Description
1	Create the Shared Services server.	Install a privileged instance of Splunk Phantom using RPM. See Install Splunk Phantom to an existing server with RPM. Run the make_server_node.pyc script to build your Shared Services server. See Run make_server_node.pyc.
2	Install Splunk Phantom cluster nodes.	Install Splunk Phantom as a virtual machine image, once for each node you need in your cluster. See Install Splunk Phantom as a virtual appliance. Make the first cluster node. See Run make_cluster_node.pyc. Make additional cluster nodes.

Build a cluster with external service services

Build a more robust cluster, putting each of the services on its own server or group of servers to serve multiple cluster nodes of Splunk Phantom.

Use the following checklist for a virtual machine images cluster with external services

Number	Task	Description
1	Create the HAProxy node.	Install a privileged instance of Splunk Phantom using RPM. See Install Splunk Phantom to an existing server with RPM. Run make_server_node install proxy. See Run make_server_node.pyc.
2	Create the PostgreSQL node.	Install a privileged instance of Splunk Phantom using RPM. See Install Splunk Phantom to an existing server with RPM. Run make_server_node install db. See Run make_server_node.pyc.
3	Create the file shares node	Install a privileged instance of Splunk Phantom using RPM. See Install Splunk Phantom to an existing server with RPM. Run make_server_node install fs. See Run make_server_node.pyc.
4	Create the Splunk Enterprise node	Install a privileged instance of Splunk Phantom using RPM. See Install Splunk Phantom to an existing server with RPM. Run make_server_node install splunk. See Run make_server_node.pyc.
5	Install Splunk Phantom cluster nodes.	Install Splunk Phantom as a virtual appliance, once for each node you need in your cluster. See Install Splunk Phantom as a virtual appliance. Run make_cluster_node.pyc to make the first cluster node. See Run make_cluster_node.pyc. Make additional cluster nodes.