splunk-enterprise-host-setup

You can bootstrap Linux hosts for self-managed Splunk Enterprise deployments by running an automated setup workflow that installs packages and configures roles. This process rapidly deploys ready-to-operate Splunk environments using either local or SSH execution.

You can automatically configure Linux hosts into Splunk Enterprise roles including standalone search tier, standalone indexer, heavy forwarder, cluster manager, indexer peer, and search head cluster members. These role-aware configurations support single-site and clustered topologies.

Splunk Enterprise host setup supports sourcing installation packages from both official URL-based downloads and local package files. This flexibility accommodates various installation topologies and air-gapped environments during automated host bootstrap.

Perform rolling upgrades on clustered Splunk Enterprise roles by executing a per-host rolling upgrade workflow. This process requires a non-secret intake worksheet for planning and uses credentials for secure secret handling during preflight validation and execution.

Before bootstrapping a Splunk indexer peer or search head cluster member, you must complete preflight validation using a non-secret intake worksheet. This planning phase verifies environment readiness and ensures proper secret handling via credentials before role deployment.