Splunk Enterprise resource spec parameters

Spec parameter reference for Splunk Enterprise custom resources.

Spec parameters for LicenseManager, Standalone, SearchHeadCluster, ClusterManager, IndexerCluster, and MonitoringConsole custom resources.

LicenseManager resource spec parameters

CODE 
apiVersion: enterprise.splunk.com/v4
kind: LicenseManager
metadata:
  name: example
spec:
  volumes:
    - name: licenses
      configMap:
        name: splunk-licenses
  licenseUrl: /mnt/licenses/enterprise.lic

See the common spec parameters for all resources and Splunk Enterprise resources. The LicenseManager resource does not provide any additional configuration parameters.

Standalone resource spec parameters

CODE 
apiVersion: enterprise.splunk.com/v4
kind: Standalone
metadata:
  name: standalone
  labels:
    app: SplunkStandAlone
    type: Splunk
  finalizers:
  - enterprise.splunk.com/delete-pvc

In addition to the common spec parameters, the Standalone resource provides the following spec configuration parameters:

Key Type Description
replicas integer The number of standalone replicas (minimum of 1, which is the default)

SearchHeadCluster resource spec parameters

CODE 
apiVersion: enterprise.splunk.com/v4
kind: SearchHeadCluster
metadata:
  name: example
spec:
  replicas: 5

In addition to the common spec parameters, the SearchHeadCluster resource provides the following spec configuration parameters:

Key Type Description
replicas integer The number of search head cluster members (minimum of 3, which is the default)

Search Head Deployer resource

Since Search Head Deployer does not require as many resources as Search Head Peers, the Splunk Operator for Kubernetes 2.7.1 introduced an additional field for the SearchHeadCluster spec to manage resources for the deployer separately.

If provided, resources are managed separately for Search Head Deployer and Search Head Peers. Otherwise, either default values are used if resources are not defined at all, or Search Head Peers resources are applied to Search Head Deployer as well.

Additionally, a node affinity specification was introduced for Search Head Deployer to separate it from the Search Head Peers specification.

Key Type Description
deployerNodeAffinity *corev1.NodeAffinity Search Head Deployer node affinity
deployerResourceSpec corev1.ResourceRequirements Search Head Deployer resource specification

Example:

CODE 
apiVersion: enterprise.splunk.com/v4
kind: SearchHeadCluster
metadata:
  name: shc
  finalizers:
    - enterprise.splunk.com/delete-pvc
spec:
  image: splunk/splunk: 9.4.4
  serviceAccount: splunk-service-account
  resources:
    requests:
      memory: "1024Mi"
      cpu: "0.2"
    limits:
      memory: "10Gi"
      cpu: "6"
  deployerResourceSpec:
    requests:
      memory: "512Mi"
      cpu: "0.1"
    limits:
      memory: "8Gi"
      cpu: "4"

ClusterManager resource spec parameters

The ClusterManager resource does not have a required spec parameter, but to configure SmartStore, you can specify indexes and volume configuration as follows:

CODE 
apiVersion: enterprise.splunk.com/v4
kind: ClusterManager
metadata:
  name: example-cm
spec:
  smartstore:
    defaults:
        volumeName: msos_s2s3_vol
    indexes:
      - name: salesdata1
        remotePath: $_index_name
        volumeName: msos_s2s3_vol
      - name: salesdata2
        remotePath: $_index_name
        volumeName: msos_s2s3_vol
      - name: salesdata3
        remotePath: $_index_name
        volumeName: msos_s2s3_vol
    volumes:
      - name: msos_s2s3_vol
        path: <remote path>
        endpoint: <remote endpoint>
        secretRef: s3-secret

IndexerCluster resource spec parameters

CODE 
apiVersion: enterprise.splunk.com/v4
kind: IndexerCluster
metadata:
  name: example
spec:
  replicas: 3
  clusterManagerRef: 
    name: example-cm
Note: The clusterManagerRef field is required for the IndexerCluster resource. It connects the IndexerCluster to the ClusterManager resource.

In addition to the common spec parameters, the IndexerCluster resource provides the following spec configuration parameters:

Key Type Description
replicas integer The number of indexer cluster members (minimum of 3, which is the default)

MonitoringConsole resource spec parameters

CODE 
apiVersion: enterprise.splunk.com/v3
kind: MonitoringConsole
metadata:
  name: example-mc
  finalizers:
  - enterprise.splunk.com/delete-pvc

Use the Monitoring Console to view detailed topology and performance information about your Splunk Enterprise deployment. See What can the Monitoring Console do? in the Splunk Enterprise documentation.

The Splunk Operator includes a CRD for the Monitoring Console (MC). This offers a number of advantages available to other CRs, including customizable resource allocation, app management, and license management.

  • An MC pod is not created automatically in the default namespace when using other Splunk Operator CRs.
  • When upgrading to the latest Splunk Operator, any previously automated MC pods are deleted.
  • To associate a new MC pod with an existing CR, you must update any CRs and add the monitoringConsoleRef parameter.

The MC pod is referenced by using the monitoringConsoleRef parameter. There is no preferred order when running an MC pod; you can start the pod before or after the other CRs in the namespace. When a pod that references the monitoringConsoleRef parameter is created or deleted, the MC pod automatically updates itself and creates or removes connections to those pods.