- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Changing from RHEL to CoreOS for Splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Changing from RHEL to CoreOS for Splunk
we are planning to change from RHEL to CoreOS. I don't have any experience on CoreOS. I need some inputs on this. Please let me know if anyone have experience on CoreOS for Splunk.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
CoreOS is designed specifically for running containers. It could be an option if you are wanting to use the Splunk Docker images (though not officially supported), but not for running Splunk on physical hardware.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for your reply.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to help! Also worth noting, Red Hat recently acquired CoreOS. So if your goal is to move away from Red Hat (usually because of support pricing), you might want to look other options. Oracle Enterprise Linux is a good choice, and of course there are many others.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i guess splunk is officially support for the docker image. please see the link below.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, Splunk released an officially supported Docker image in v7.2. But that image does not use CoreOS as the underlying operating system.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
but the document says it will support any linux-based operating system. CoreOS is also linux but for containers, right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you may be confusing the container/image OS with the platform OS.
The platform OS would be the server on which you are running Docker, while the container/image OS is the OS that actually runs inside the container.
Splunk supports running Docker on any (or most) versions of Linux with a Kernel version > 4.0 according to the documentation. But, the officially published Splunk Docker image is built on either Centos or Debian.
You can build your own image using another flavor of Linux (CoreOS e.g.) but I do not believe that is officially supported by Splunk.
https://github.com/splunk/docker-splunk/tree/develop/base
An upvote would be appreciated and Accept Solution if it helps!
Detecting Remote Code Executions With the Splunk Threat Research Team
Enter the Splunk Community Dashboard Challenge for Your Chance to Win!
.conf24 | Session Scheduler is Live!!
