<div id="readability-page-1" class="page"><div>[root@Splunk&nbsp;~]#&nbsp;rpm&nbsp;-ivh&nbsp;splunk-9.4.3-237ebbd22314.x86_64.rpm&nbsp;--forcewarning:&nbsp;splunk-9.4.3-237ebbd22314.x86_64.rpm:&nbsp;Header&nbsp;V4&nbsp;RSA/SHA256&nbsp;Signature,&nbsp;key&nbsp;ID&nbsp;b3cd4420:&nbsp;NOKEYPreparing...&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#################################&nbsp;[100%]no&nbsp;need&nbsp;to&nbsp;run&nbsp;the&nbsp;pre-install&nbsp;checkuseradd:&nbsp;cannot&nbsp;create&nbsp;directory&nbsp;/opt/splunkUpdating&nbsp;/&nbsp;installing...1:splunk-9.4.3-237ebbd22314&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#################################&nbsp;[100%]complete[root@Splunk&nbsp;~]#&nbsp;whereis&nbsp;splunksplunk:&nbsp;/opt/splunk/bin/splunk[root@Splunk&nbsp;~]#&nbsp;/opt/splunk/bin/splunk&nbsp;start&nbsp;--accept-licenseThis&nbsp;appears&nbsp;to&nbsp;be&nbsp;your&nbsp;first&nbsp;time&nbsp;running&nbsp;this&nbsp;version&nbsp;of&nbsp;Splunk.Splunk&nbsp;software&nbsp;must&nbsp;create&nbsp;an&nbsp;administrator&nbsp;account&nbsp;during&nbsp;startup.&nbsp;Otherwise,&nbsp;you&nbsp;cannot&nbsp;log&nbsp;in.Create&nbsp;credentials&nbsp;for&nbsp;the&nbsp;administrator&nbsp;account.Characters&nbsp;do&nbsp;not&nbsp;appear&nbsp;on&nbsp;the&nbsp;screen&nbsp;when&nbsp;you&nbsp;type&nbsp;in&nbsp;credentials.Please&nbsp;enter&nbsp;an&nbsp;administrator&nbsp;username:&nbsp;adminPassword&nbsp;must&nbsp;contain&nbsp;at&nbsp;least:*&nbsp;8&nbsp;total&nbsp;printable&nbsp;ASCII&nbsp;character(s).Please&nbsp;enter&nbsp;a&nbsp;new&nbsp;password:Please&nbsp;confirm&nbsp;new&nbsp;password:Copying&nbsp;'/opt/splunk/etc/openldap/ldap.conf.default'&nbsp;to&nbsp;'/opt/splunk/etc/openldap/ldap.conf'.Generating&nbsp;RSA&nbsp;private&nbsp;key,&nbsp;2048&nbsp;bit&nbsp;long&nbsp;modulus..................................................................+++++...............+++++e&nbsp;is&nbsp;65537&nbsp;(0x10001)writing&nbsp;RSA&nbsp;keyGenerating&nbsp;RSA&nbsp;private&nbsp;key,&nbsp;2048&nbsp;bit&nbsp;long&nbsp;modulus........................................+++++............................+++++e&nbsp;is&nbsp;65537&nbsp;(0x10001)writing&nbsp;RSA&nbsp;keyMoving&nbsp;'/opt/splunk/share/splunk/search_mrsparkle/modules.new'&nbsp;to&nbsp;'/opt/splunk/share/splunk/search_mrsparkle/modules'.Splunk&gt;&nbsp;All&nbsp;batbelt.&nbsp;No&nbsp;tights.Checking&nbsp;prerequisites...&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;http&nbsp;port&nbsp;[8000]:&nbsp;open&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;mgmt&nbsp;port&nbsp;[8089]:&nbsp;open&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;appserver&nbsp;port&nbsp;[127.0.0.1:8065]:&nbsp;open&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;kvstore&nbsp;port&nbsp;[8191]:&nbsp;open&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;configuration...&nbsp;Done.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/lib/splunk&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk/appserver/i18n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk/appserver/modules/static/css&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk/upload&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk/search_telemetry&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk/search_log&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/spool/splunk&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/spool/dirmoncache&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/lib/splunk/authDb&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/lib/splunk/hashDb&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk/collect&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Creating:&nbsp;/opt/splunk/var/run/splunk/sessionsNew&nbsp;certs&nbsp;have&nbsp;been&nbsp;generated&nbsp;in&nbsp;'/opt/splunk/etc/auth'.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;critical&nbsp;directories...&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Done&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;indexes...&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Validated:&nbsp;_audit&nbsp;_configtracker&nbsp;_dsappevent&nbsp;_dsclient&nbsp;_dsphonehome&nbsp;_internal&nbsp;_introspection&nbsp;_metrics&nbsp;_metrics_rollup&nbsp;_telemetry&nbsp;_thefishbucket&nbsp;history&nbsp;main&nbsp;summary&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Done&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;filesystem&nbsp;compatibility...&nbsp;&nbsp;Done&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;conf&nbsp;files&nbsp;for&nbsp;problems...&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Done&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checking&nbsp;default&nbsp;conf&nbsp;files&nbsp;for&nbsp;edits...&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Validating&nbsp;installed&nbsp;files&nbsp;against&nbsp;hashes&nbsp;from&nbsp;'/opt/splunk/splunk-9.4.3-237ebbd22314-linux-amd64-manifest'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;All&nbsp;installed&nbsp;files&nbsp;intact.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DoneAll&nbsp;preliminary&nbsp;checks&nbsp;passed.Starting&nbsp;splunk&nbsp;server&nbsp;daemon&nbsp;(splunkd)...Generating&nbsp;a&nbsp;RSA&nbsp;private&nbsp;key.+++++..........................+++++writing&nbsp;new&nbsp;private&nbsp;key&nbsp;to&nbsp;'privKeySecure.pem'-----Signature&nbsp;oksubject=/CN=Splunk/O=SplunkUserGetting&nbsp;CA&nbsp;Private&nbsp;Keywriting&nbsp;RSA&nbsp;keyPYTHONHTTPSVERIFY&nbsp;is&nbsp;set&nbsp;to&nbsp;0&nbsp;in&nbsp;splunk-launch.conf&nbsp;disabling&nbsp;certificate&nbsp;validation&nbsp;for&nbsp;the&nbsp;httplib&nbsp;and&nbsp;urllib&nbsp;libraries&nbsp;shipped&nbsp;with&nbsp;the&nbsp;embedded&nbsp;Python&nbsp;interpreter;&nbsp;must&nbsp;be&nbsp;set&nbsp;to&nbsp;"1"&nbsp;for&nbsp;increased&nbsp;securityDone&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[&nbsp;&nbsp;OK&nbsp;&nbsp;]Waiting&nbsp;for&nbsp;web&nbsp;server&nbsp;at&nbsp;http://127.0.0.1:8000&nbsp;to&nbsp;be&nbsp;available........................&nbsp;DoneIf&nbsp;you&nbsp;get&nbsp;stuck,&nbsp;we're&nbsp;here&nbsp;to&nbsp;help.Look&nbsp;for&nbsp;answers&nbsp;here:&nbsp;http://docs.splunk.comThe&nbsp;Splunk&nbsp;web&nbsp;interface&nbsp;is&nbsp;at&nbsp;http://Splunk:8000</div></div>

케세라세라

스플렁크 RPM 설치 실패.
[root@Splunk ~]# rpm -ivh splunk-9.4.3-237ebbd22314.x86_64.rpm
error: splunk-9.4.3-237ebbd22314.x86_64.rpm: headerRead failed: hdr data: BAD, no. of bytes(19932197) out of range
error: splunk-9.4.3-237ebbd22314.x86_64.rpm cannot be installed
Colored by Color Scripter
cs
헤더 정보를 못 읽는다는 뜻인가? 설치 파일은 문제가 없는 것 같은데?
[root@Splunk ~]# file splunk-9.4.3-237ebbd22314.x86_64.rpm
splunk-9.4.3-237ebbd22314.x86_64.rpm: RPM v3.0 bin i386/x86_64 splunk-9.4.3-237ebbd22314
cs
검색해보니 RPM-4.14.3 이상 버전을 사용하면 해결된다는데 문제는 없데이트가 안 된다.
================================================================================
 Package              Arch         Version                  Repository     Size
================================================================================
Updating:
 rpm                  x86_64       4.11.3-48.el7_9          updates       1.2 M
 rpm-libs             x86_64       4.11.3-48.el7_9          updates       279 k
Updating for dependencies:
 rpm-build-libs       x86_64       4.11.3-48.el7_9          updates       108 k
 rpm-python           x86_64       4.11.3-48.el7_9          updates        84 k
 
Transaction Summary
================================================================================
Upgrade  2 Packages (+2 Dependent packages)
 
Total download size: 1.6 M
Is this ok [y/d/N]:
Colored by Color Scripter
cs
rpmfind.net 뒤져봤는데 설치 파일도 없고 해서 그냥 강제 설치(..)
[root@Splunk ~]# rpm -ivh splunk-9.4.3-237ebbd22314.x86_64.rpm --force
warning: splunk-9.4.3-237ebbd22314.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID b3cd4420: NOKEY
Preparing...                          ################################# [100%]
no need to run the pre-install check
useradd: cannot create directory /opt/splunk
Updating / installing...
   1:splunk-9.4.3-237ebbd22314        ################################# [100%]
complete
[root@Splunk ~]# whereis splunk
splunk: /opt/splunk/bin/splunk
[root@Splunk ~]# /opt/splunk/bin/splunk start --accept-license
 
This appears to be your first time running this version of Splunk.
 
Splunk software must create an administrator account during startup. Otherwise, you cannot log in.
Create credentials for the administrator account.
Characters do not appear on the screen when you type in credentials.
 
Please enter an administrator username: admin
Password must contain at least:
   * 8 total printable ASCII character(s).
Please enter a new password:
Please confirm new password:
Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/etc/openldap/ldap.conf'.
Generating RSA private key, 2048 bit long modulus
..................................................................+++++
...............+++++
e is 65537 (0x10001)
writing RSA key
 
Generating RSA private key, 2048 bit long modulus
........................................+++++
............................+++++
e is 65537 (0x10001)
writing RSA key
 
Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/opt/splunk/share/splunk/search_mrsparkle/modules'.
 
Splunk> All batbelt. No tights.
 
Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking appserver port [127.0.0.1:8065]: open
        Checking kvstore port [8191]: open
        Checking configuration... Done.
                Creating: /opt/splunk/var/lib/splunk
                Creating: /opt/splunk/var/run/splunk
                Creating: /opt/splunk/var/run/splunk/appserver/i18n
                Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css
                Creating: /opt/splunk/var/run/splunk/upload
                Creating: /opt/splunk/var/run/splunk/search_telemetry
                Creating: /opt/splunk/var/run/splunk/search_log
                Creating: /opt/splunk/var/spool/splunk
                Creating: /opt/splunk/var/spool/dirmoncache
                Creating: /opt/splunk/var/lib/splunk/authDb
                Creating: /opt/splunk/var/lib/splunk/hashDb
                Creating: /opt/splunk/var/run/splunk/collect
                Creating: /opt/splunk/var/run/splunk/sessions
New certs have been generated in '/opt/splunk/etc/auth'.
        Checking critical directories...        Done
        Checking indexes...
                Validated: _audit _configtracker _dsappevent _dsclient _dsphonehome _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history main summary
        Done
        Checking filesystem compatibility...  Done
        Checking conf files for problems...
        Done
        Checking default conf files for edits...
        Validating installed files against hashes from '/opt/splunk/splunk-9.4.3-237ebbd22314-linux-amd64-manifest'
        All installed files intact.
        Done
All preliminary checks passed.
 
Starting splunk server daemon (splunkd)...
Generating a RSA private key
.+++++
..........................+++++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=Splunk/O=SplunkUser
Getting CA Private Key
writing RSA key
PYTHONHTTPSVERIFY is set to 0 in splunk-launch.conf disabling certificate validation for the httplib and urllib libraries shipped with the embedded Python interpreter; must be set to "1" for increased security
Done
                                                           [  OK  ]
 
Waiting for web server at http://127.0.0.1:8000 to be available........................ Done
 
 
If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com
The Splunk web interface is at http://Splunk:8000
Colored by Color Scripter
cs
잘 되는 듯.
관련 글
CentOS의 Splunk
SplunkForwarder v9
Could not bind to port 8089
스플렁크와 엘라스틱 서비스 실행 차이

CentOS의 Splunk - 2nd

댓글