Splunk Enterprise Security Install

Splunk Enterprise Security Install

Prerequisites

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

• Install, upgrade, bootstrap, post-install, or validate Splunk Enterprise Security.
• Preview and review the splunk enterprise security install workflow before any live apply phase.
• Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Scope

Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.

Examples

Inspect the supported setup modes before selecting one:

bash skills/splunk-enterprise-security-install/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/splunk-enterprise-security-install/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

Shared add-on completion gate

Whenever this workflow installs, configures, or hands off a registry-listed Splunk app or add-on, follow the shared completion gate. Package delivery alone is not success; capture applicable configuration, data/readiness, and shipped-view evidence, or explicit package evidence that no dashboards ship.

Installs and validates Splunk Enterprise Security (SplunkEnterpriseSecuritySuite).

Agent Behavior

Never ask for secrets in chat. Splunk and Splunkbase credentials are read from the project-root credentials file, falling back to ~/.splunk/credentials. If neither exists, guide the user to run:

bash skills/shared/scripts/setup_credentials.sh

Use the local package under splunk-ta/ first when it exists. If no local ES package is available, use Splunkbase app ID 263; pass --app-version to force a specific Splunkbase version.

For Splunk Cloud Platform, do not self-service install ES unless the customer has an explicitly supported ACS/support process. Splunk Cloud customers usually coordinate ES search-head access and installation with Splunk Support.

The public ES 8.5.1 listing includes platform 10.5. In this repository, 10.5 is the current Splunk Cloud target and does not change the self-managed Enterprise default from 10.4.1. Confirm the target-specific ES compatibility matrix and supported Cloud installation process rather than presenting the cross-product listing as self-managed Enterprise 10.5 validation.

Package Verification Boundary

The reviewed pin is 8.5.1; the current public release is 8.6.1, which also advertises 10.5. The pin stays on 8.5.1 because the Splunkbase download for 263 is entitlement-gated and returns HTTP 403 without an Enterprise Security entitlement, so 8.6.1 could not be downloaded, unpacked, or inspected here. Nothing about that hold blocks the default install path, which still resolves a 10.5-capable release. To install 8.6.1, supply it explicitly with --app-version (or a local package under splunk-ta/) after reviewing the 8.6.1 release notes and app contents yourself; the app names, indexes, and post-install steps in this skill are derived from the 8.5.1 package and have not been re-derived against 8.6.1.

Environment

Remote Splunk Connection

export SPLUNK_SEARCH_API_URI="https://splunk-host:8089"

Workflow

1. Read the reference for version-specific notes:

   skills/splunk-enterprise-security-install/reference.md
   

2. Preflight the target:

   • ES is a premium product and requires a valid license.
   • The user must be an admin or equivalent with app-install capabilities.
   • Ensure KV Store is healthy and /tmp has approximately 3 GB free.
   • Remove deploymentclient.conf from apps managed by a deployment server.
   • On SHC deployers, back up etc/shcluster/apps, one member's etc/apps, and one member's KV Store before install.

3. Install and run ES post-install:

   bash skills/splunk-enterprise-security-install/scripts/setup.sh
   

   Defaults: install/update ES from the local package when present, otherwise Splunkbase app 263, run | essinstall, then validate.

4. For SHC deployers, pass the deployer mode and then apply the bundle:

   bash skills/splunk-enterprise-security-install/scripts/setup.sh \
     --deployment-type shc_deployer
   

   Then run splunk apply shcluster-bundle from the deployer using local Splunk CLI credentials or your normal SHC operations process.

5. Validate:

   bash skills/splunk-enterprise-security-install/scripts/validate.sh
   

Scripts

setup.sh

Installs the ES package, runs preflight checks, runs post-install setup, and optionally orchestrates the SHC bundle apply and the Splunk_TA_ForIndexers handoff for clustered indexers.

Useful flags:

generate_ta_for_indexers.sh

Extracts the Splunk Cloud-variant Splunk_TA_ForIndexers tarball from a local ES package into a target directory. This is what operators stage under $SPLUNK_HOME/etc/manager-apps/Splunk_TA_ForIndexers on the cluster manager before running splunk apply cluster-bundle.

validate.sh

Runs read-only checks for:

• Splunk API authentication
• ES suite version and configured state
• Required framework apps and bundled supporting apps
• KV Store status
• Data model acceleration enforcement stanzas
• Search-head and SHC platform limits (max_upload_size, max_content_length, splunkdConnectionTimeout)
• Splunk_TA_ForIndexers presence on the connected tier
• Key ES indexes, with warnings for distributed deployments where indexes live on another tier

Key Rules

• Do not disable Mission Control; it is part of ES 8.x.
• Do not disable ES framework apps with SA- or DA-ESS- names.
• ES 8.x upgrades are one-way; perform a full search-head and KV Store backup first.
• ES 8.x on on-prem Splunk Enterprise 10.x must be installed from the command line rather than uploaded through Splunk Web.
• Run essinstall --deployment_type shc_deployer for SHC deployers.
• ssl_enablement=auto is not valid for SHC deployer installs.

Additional Resources

• reference.md — researched ES install requirements, package contents, version notes, and validation details.