For starting installation of Splunk, we need to make sure a couple of prerequisites are met so that
after installation, our Splunk should be able to run without any performance issues.
Let's begin with discussing about firewall rules.
Which should be mainly focusing on Port 8000.
Which is our Splunk Web port and 1889, which is our Splunk daemon, are also known as Management Port.
The Splunk web port.
8000 should be allowed for HTTP and https traffic.
There are few more ports like K Vista, which is 8191 and observer ports like 8065, which are used
in specific scenarios locally which shouldn't cause any trouble for our installation.
To summarize, make sure HTTP and HTTPS are allowed on port 8080 89 port from deployment server and
other indexes of orders and search it.
And any other components of Splunk.
One more important firewall request to take into consideration is universal forwarder to index their
communication on port triple line seven that is 9997, which is used to send logs to our indexes.
This port is by default, which can be customized into any other port.
That should be it for starting the installation.
Once we have the firewall rules set.
So now we are met with our first prerequisite.
Let's move on.
The next prerequisite.
Some of the process in Linux are known to cause issues during Splunk regular operations.
So it is recommended by Splunk to disable some of these process on Splunk servers.
One such process is known as HP or Transparent huge pages, which are known to cause many issues while
running alongside Splunk.
So it is recommended by Splunk to disable these process before.
Installing our Splunk.
And this is the location of the file.
If we have transparent, huge pages installed on our red ATM machine or.
St Louis.
This is the location where you can change the entry in this file to disable sense in our cloud.
We can see if we are transparent, huge pages installed or not.
Let me copy the location of the file.
I'll check whether we have that file or the processing store.
Now, in our instance, we don't have transparent, huge pages or the THP end store.
It's safe to consider it as disabled.