Install Splunk Phantom on a system with limited internet access
Use a tar file to install Splunk Phantom without an internet connection.
Prerequisites
Contact Phantom support to get this installation file. You can open a support case at Splunk Support and Services or by calling +1(855)SPLUNK-S or +1(855)775-8657. International Splunk Support numbers are found in the Contact Us section of the Splunk website.
Supported operating systems for this method:
- Red Hat Enterprise Linux 7.6 through 7.9
- CentOS 7.6 through 7.9
On Red Hat Enterprise Linux, you must either create a satellite server or local YUM repository for operating system packages and other dependencies. See the Red Hat Knowledgebase article How can we regularly update a disconnected system (A system without internet connection)?
Operating System | Repositories |
---|---|
CentOS 7.6 through 7.9 | os updates |
Red Hat Enterprise Linux 7.6 through 7.9 | rhel-7-server-rpms rhel-7-server-optional-rpms rhel-server-rhscl-7-rpms |
Red Hat Enterprise Linux on AWS | rhui-<region>-rhel-server-optional |
Update the operating system and dependencies
Do these tasks with root permissions, either by logging in as root or as a user with sudo permission.
- Contact Splunk Phantom Support to get access to the offline installer tar file. Once access has been granted, you can download the file from the Splunk Phantom community website.
- Clear YUM's caches. yum clean all
- Update the operating system and all installed packages. yum update
- Restart the operating system. shutdown -r now
Install Splunk Phantom from the tar file
- Make a directory for the tar file.
mkdir /usr/local/src/upgrade-<version>
- Change to the created directory.
cd /usr/local/src/upgrade-<version>
- Download or copy the tar file to the directory.
- Extract the tar file.
tar -xvzf phantom_offline_setup_<OS>-<version>.tgz
- Change to the directory phantom_offline_setup:
cd phantom_offline_setup_<OS><version>
- Run the installation script.
./phantom_offline_setup_<OS>.sh install
To install without apps, add
--without-apps
to the command:./phantom_offline_setup_<OS>.sh install --without-apps
Next step: log in to verify the installation
You can log in to the Splunk Phantom web interface after the setup script completes to configure user accounts and additional settings. See Log in to the Splunk Phantom web interface.
Install Splunk Phantom to an existing server with RPM | Install Splunk Phantom as an unprivileged user |
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7
Feedback submitted, thanks!