Splunk® SOAR (On-premises)

Install and Upgrade Splunk SOAR (On-premises)

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.

Install on a system with limited internet access

Use a tar file to install without an internet connection.

Prerequisites

Contact support to get this installation file. You can open a support case at Splunk Support and Services or by calling +1(855)SPLUNK-S or +1(855)775-8657. International Splunk Support numbers are found in the Contact Us section of the Splunk website.

Supported operating systems for this method:

  • Red Hat Enterprise Linux 7.6 through 7.9
  • CentOS 7.6 through 7.9

On Red Hat Enterprise Linux, you must either create a satellite server or local YUM repository for operating system packages and other dependencies. See the Red Hat Knowledgebase article How can we regularly update a disconnected system (A system without internet connection)?

Operating System Repositories
CentOS 7.6 through 7.9 os
updates
Red Hat Enterprise Linux 7.6 through 7.9 rhel-7-server-rpms
rhel-7-server-optional-rpms
rhel-server-rhscl-7-rpms
Red Hat Enterprise Linux on AWS rhui-<region>-rhel-server-optional

Update the operating system and dependencies

Do these tasks with root permissions, either by logging in as root or as a user with sudo permission.

  1. Contact Support to get access to the offline installer tar file. Once access has been granted, you can download the file from the community website.
  2. Clear YUM's caches.
    yum clean all
  3. Update the operating system and all installed packages.
    yum update
  4. Restart the operating system.
    shutdown -r now

Install from the tar file

  1. Make a directory for the tar file.
    mkdir /usr/local/src/upgrade-<version>
  2. Change to the created directory.
    cd /usr/local/src/upgrade-<version>
  3. Download or copy the tar file to the directory.
  4. Extract the tar file.
    tar -xvzf phantom_offline_setup_<OS>-<version>.tgz
  5. Change to the directory phantom_offline_setup:
    cd phantom_offline_setup_<OS><version>
  6. Run the installation script.
    ./phantom_offline_setup_<OS>.sh install

    To install without apps, add --without-apps to the command:

    ./phantom_offline_setup_<OS>.sh install --without-apps

Next step: log in to verify the installation

You can log in to the web interface after the setup script completes to configure user accounts and additional settings. See Log in to the web interface.

Last modified on 18 March, 2022
Install to an existing server with RPM   Install as an unprivileged user

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters