Splunk Admin Roadmap - Day 3 - How to Setup an Indexer
Splunk Indexer Installation from Scratch | Step-by-Step Guide (Linux)
In this video, we explain how to set up a Splunk Indexer from scratch on a Linux server. This session covers pre-installation checks, OS-level validations, installation steps, CLI commands, and post-installation configuration in a detailed and practical way.
What You’ll Learn in This Video:
Complete Splunk Indexer setup from scratch
Pre-installation OS checks and validations
Disk, CPU, memory, and user verification
Checking Splunk directory ownership and permissions
Port availability and firewall checks
THP (Transparent Huge Pages) validation
U-limit configuration checks
NTP synchronization verification
Downloading and installing Splunk using CLI
Accepting the license and starting Splunk services
Accessing Splunk Web UI
Configuring server name and global banner
Verifying Splunk ports (Web, Management, KV Store, App Server)
Post-installation steps and boot-time configuration overview
Pre-Installation Checks Covered:
OS version verification
Disk partition and storage size check
CPU cores and architecture check
Memory availability check
Splunk user and directory validation
Directory ownership and permissions
Port validation (8000, 8089, 9997, 514, etc.)
THP disabled confirmation
U-limit settings validation
NTP sync status check
Installation Steps:
Downloading Splunk using wget
Extracting the Splunk package
Starting Splunk with license acceptance
Setting admin credentials
Accessing Splunk Web (Port 8000)
Post-Installation Configuration:
Server name verification
Default hostname check
Web, management, KV store, and app server ports validation
Global banner configuration
Boot-time service configuration (Linux systemd overview)
Who Is This Video For?
Splunk Beginners & Administrators
SOC Analysts & SIEM Engineers
Linux & DevOps Engineers
Anyone learning Splunk Indexer Administration
This setup follows Splunk best practices and is aligned with real-time production and lab environments.