Create a standalone instance

Deploy a single Splunk Enterprise instance using the Standalone custom resource.

The two basic building blocks of Splunk Enterprise infrastructure are search heads and indexers. Use a Standalone resource to create a single instance that can perform either, or both of these roles. The following example creates a deployment named s1.

  1. Run the command to create the deployment:
    CODE 
    cat <<EOF | kubectl apply -n splunk-operator -f -
apiVersion: enterprise.splunk.com/v4
kind: Standalone
metadata:
  name: s1
  finalizers:
  - enterprise.splunk.com/delete-pvc
EOF

    The enterprise.splunk.com/delete-pvc finalizer is optional. It tells the Splunk Operator to remove any Kubernetes Persistent Volumes associated with the instance if you delete the custom resource (CR).

  2. Verify the pods are running:

    Within a few minutes, new pods appear in your namespace:

    CODE 
    $ kubectl get pods
NAME                                   READY   STATUS    RESTARTS   AGE
splunk-operator-7c5599546c-wt4xl        1/1    Running   0          11h
splunk-s1-standalone-0                  1/1    Running   0          45s
  3. Open port 8000 for Splunk Web access:
    CODE 
    kubectl port-forward splunk-s1-standalone-0 8000
  4. Get the passwords for the namespace.

    The Splunk Enterprise passwords used in the namespace are generated automatically. To learn how to find and read the passwords, see the documentation for reading the global Kubernetes secret object.

  5. Log in to Splunk Enterprise at http://localhost:8000 using the admin account with the password.
  6. To delete your standalone deployment, run:
    CODE 
    kubectl delete standalone s1

You have a running Standalone deployment of Splunk Enterprise that you can access through Splunk Web.

The Standalone custom resource is one of the resources the Splunk Operator provides. You can find more custom resources and the parameters they support in the Custom Resource reference.