Install Splunk Phantom to an existing server with RPM
Use this method to install on local hardware or a cloud service, such as AWS or Azure. Use your Splunk Phantom Community credentials during the installation.
Prerequisites
Contact Phantom support to get the specific installation package you need. You can open a support case at Splunk Support and Services or by calling +1(855)SPLUNK-S or +1(855)775-8657. International Splunk Support numbers are found in the Contact Us section of the Splunk website.
Add the required additional YUM repositories for your operating system.
Some users may need edit the /etc/yum.repos.d/redhat-rhui.repo
file to enable the additional Red Hat Enterprise Linux repository. AWS users must do so on their AWS instance.
Operating System | Repositories |
---|---|
CentOS 7.6 -7.9 | os updates |
Red Hat Enterprise Linux 7.6 - 7.9 | rhel-7-server-rpms rhel-7-server-optional-rpms rhel-server-rhscl-7-rpms |
Red Hat Enterprise Linux on AWS | rhui-<region>-rhel-server-optional |
Update the operating system and dependencies
Do these actions either as the root user or a user with sudo permissions.
- Contact Splunk Phantom Support to get access to the required RPM files. Once access has been granted, you can download the file from the Splunk Phantom community website.
- Clear YUM's caches. yum clean all
- Update the operating system and all installed packages. yum update
- Restart the operating system. shutdown -r now
Install Splunk Phantom
Perform the following tasks to install Splunk Phantom:
- As either root or a user with sudo access, run RPM to add the required repositories, GPG keys, and the installation script.
- CentOS version 7:
- RHEL version 7:
- As either root or a user with sudo access, run the installation script.
/opt/phantom/bin/phantom_setup.sh installProvide your Splunk Phantom community credentials when prompted for a username and password.
For more installation command line options, see phantom_setup.sh options.
If you need to download the RPM, see Install Splunk Phantom on a system with limited internet access.
Next step: log in to verify the installation
You can log in to the Splunk Phantom web interface after the setup script completes to configure user accounts and additional settings. See Log in to the Splunk Phantom web interface.
Install Splunk Phantom as a virtual machine image | Install Splunk Phantom on a system with limited internet access |
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.10, 4.10.1
Feedback submitted, thanks!