Splunk® SOAR (On-premises)

Install and Upgrade Splunk SOAR (On-premises)

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.

Create a cluster using a privileged installation

Do not use this release to create new clusters of Splunk SOAR (On-premises).

Use this release to upgrade from your current privileged deployment of Splunk Phantom 4.10.7 or Splunk SOAR (On-premises) releases 5.0.1 through 5.3.4.

If you are upgrading a privileged deployment of Splunk Phantom 4.10.7 or Splunk SOAR (On-premises) releases 5.0.1 through 5.3.4, upgrade to release 5.3.6, convert your deployment to unprivileged, then upgrade again directly to Splunk SOAR (On-premises) release 6.1.1 or higher.

If you have a privileged deployment of Splunk SOAR (On-premises) release 5.3.5, convert your deployment to unprivileged, then upgrade directly to Splunk SOAR (On-premises) release 6.1.1 or higher.

To learn how to upgrade see Splunk SOAR (On-premises) upgrade overview and prerequisites.

Build a cluster, putting each of the services on its own server or group of servers to serve multiple cluster nodes of .

Number Task Description
1 Create the HAProxy server. Use the HAProxy server to be a load balancer for the nodes in your cluster. See Set up a load balancer with an HAProxy server.
2 Create the PostgreSQL server or cluster. Establish a PostgreSQL database server or cluster to store information. See Set up an external PostreSQL server.
3 Create the file shares server. will store all its shared files on the prepared GlusterFS server. You can use NFS or other network file system. Instructions for that are not included in this document. See Set up external file shares using GlusterFS.
4 Install Splunk Enterprise. will use Splunk Enterprise for searches and collect data for indexing using the HTTP Event Collector. See Set up Splunk Enterprise.
5 Install cluster nodes.
  1. Install using the TAR file method for unprivileged installs. Do this once for each node you need in your cluster. See Install as a privileged user or Install as an unprivileged user.
  2. Make the first node with make_cluster_node.pyc. See Run make_cluster_node.pyc.
  3. Make additional nodes.
Last modified on 19 September, 2023
About clusters   Create a cluster using an unprivileged installation

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.3.6

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters