Create a Splunk Phantom cluster using an unprivileged installation
Build a cluster, putting each of the services on its own server or group of servers to serve multiple cluster nodes of Splunk Phantom.
Set up each of the external services either as the root user or a user with sudo permissions.
Install Splunk Phantom as an unprivileged user. In your cluster, each Splunk Phantom instance must have the same custom username and install directory. See Install Splunk Phantom as an unprivileged user.
Number | Task | Description |
---|---|---|
1 | Create the HAProxy server. | Use the HAProxy server to be a load balancer for the Splunk Phantom nodes in your cluster. See Set up a load balancer with an HAProxy server. There are additional steps to configure your load balancer to handle your custom HTTPS port for unprivileged clusters. |
2 | Create the PostgreSQL server. | Establish a PostgreSQL database server or cluster to store Splunk Phantom information. See Set up the external PostreSQL server. |
3 | Create the file shares server. | Splunk Phantom will store all its shared files on the prepared GlusterFS server. You can use NFS or other network file system. Instructions for that are not included in this document. See Set up external file shares using GlusterFS. |
4 | Create the Splunk Enterprise server. | Splunk Phantom will use Splunk Enterprise for searches and collect data for indexing using the HTTP Event Collector. See Set up Splunk Enterprise. |
5 | Install Splunk Phantom cluster nodes. |
|
Create a Splunk Phantom cluster from an RPM or TAR file installation | Create a Splunk Phantom Cluster in Amazon Web Services |
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8, 4.9
Feedback submitted, thanks!