Create a Splunk Phantom Cluster from an OVA installation
Converting a Splunk Phantom virtual appliance to a server or cluster node is a one-way operation. It cannot be reverted.
The most basic version of a Splunk Phantom cluster is a single Shared Services server connected to multiple instances of Splunk Phantom.
This configuration is not recommended for production use. This mode is primarily intended for Proof of Value or demonstrations. A single Shared Services server becomes a single point of failure. Any problems on the Shared Services server impact your entire Splunk Phantom cluster.
Use the following checklist for a Single Shared Services server
|1||Create the Shared Services server.|
|2||Install Splunk Phantom cluster nodes.|
Build a cluster with external service services
Build a more robust cluster, putting each of the services on its own server or group of servers to serve multiple cluster nodes of Splunk Phantom.
Use the following checklist for a virtual machine images cluster with external services
|1||Create the HAProxy node.|
|2||Create the PostgreSQL node.|
|3||Create the file shares node|
|4||Create the Splunk Enterprise node|
|5||Install Splunk Phantom cluster nodes.|
About Splunk Phantom clusters
Create a Splunk Phantom cluster from an RPM or TAR file installation
This documentation applies to the following versions of Splunk® Phantom: 4.8, 4.9