Install Splunk Enterprise using Helm

Install, configure, and uninstall Splunk Enterprise deployments using Helm.

Deploy Splunk Enterprise custom resources using the splunk/splunk-enterprise Helm chart. This chart has the splunk/splunk-operator chart as a dependency by default.

If the operator is already installed, turn off the dependency:

CODE 
helm install --set splunk-operator.enabled=false <RELEASE_NAME> splunk/splunk-enterprise -n <RELEASE_NAMESPACE>

Install Splunk Enterprise

Create a new_values.yaml file to specify override configurations for your deployment.

For more information about configurable values, see splunk/splunk-enterprise values.

The following example configures a Cluster Manager, an Indexer Cluster, and a Search Head Cluster:

CODE 
clusterManager:
  enabled: true
  name: cm-test

indexerCluster:
  enabled: true
  name: idxc-test

searchHeadCluster:
  enabled: true
  name: shc-test

To see all configurable values contained in the values.yaml file, run the following command:

CODE 
helm show values splunk/splunk-enterprise

Install the Splunk Enterprise deployment using your configuration file:

CODE 
helm install -f new_values.yaml <RELEASE_NAME> splunk/splunk-enterprise -n <RELEASE_NAMESPACE>

The following example installs the splunk-enterprise-test release in the splunk-operator namespace:

CODE 
helm install -f new_values.yaml splunk-enterprise-test splunk/splunk-enterprise -n splunk-operator

Expected output:

CODE 
NAME: splunk-enterprise-test
LAST DEPLOYED: Tue Aug 23 12:11:48 2022
NAMESPACE: splunk-operator
STATUS: deployed
REVISION: 1
TEST SUITE: None

Verify the pods are running:

CODE 
splunk-cm-test-cluster-manager-0                      1/1     Running   0               11m
splunk-idxc-test-indexer-0                            1/1     Running   0               5m49s
splunk-idxc-test-indexer-1                            1/1     Running   0               5m49s
splunk-idxc-test-indexer-2                            1/1     Running   0               5m49s
splunk-operator-controller-manager-xxxx-xxxx		   1/1     Running   0               11m
splunk-shc-test-deployer-0                            1/1     Running   0               11m
splunk-shc-test-search-head-0                         1/1     Running   0               11m
splunk-shc-test-search-head-1                         1/1     Running   0               11m
splunk-shc-test-search-head-2                         1/1     Running   0               11m

Uninstall Splunk Enterprise

To remove the deployment, use helm uninstall:

CODE 
helm uninstall <RELEASE_NAME> -n <RELEASE_NAMESPACE>

The helm uninstall command terminates all resources deployed by Helm.

Note: Helm does not clean up Custom Resource Definitions and Persistent Volume Claims by default. You must manually clean them up.

The following example uninstalls the splunk-enterprise-test release:

CODE 
helm uninstall splunk-enterprise-test -n splunk-operator

Expected output:

release "splunk-enterprise-test" uninstalled

Splunk Validated Architecture deployments

The splunk/splunk-enterprise chart supports the following Splunk Validated Architectures:

Install a Standalone deployment using the following command:

CODE 
helm install --set s1.enabled=true <RELEASE_NAME> splunk/splunk-enterprise -n <RELEASE_NAMESPACE>