Skip to main content
Version: Atlas v4.0

Atlas Installation Overview

Atlas Requirements​

Regardless what what deployment architecture chosen for Atlas, a dedicated Search Head or Search Head cluster is required on your on-premise or in-cloud environment. This Search Head will be referred to as the “Atlas Search Head” throughout the documentation.

Atlas Search Head Sizing Requirements​

The Atlas Search Head should reflect the system resource recommendations for a Splunk Enterprise on-premise search head as provided in Splunk’s Capacity Planning documentation found at this location.

If you are evaluating Atlas, you can consider the following 'Evaluation only' specifications as minimum requirements for the Atlas Search Head. This should provide enough resources to evaluate Atlas features, but as you start adding more users on the Atlas Search Head, you will need to increase the resources accordingly.

Always remember that the Atlas Expertise on Demand Team can be leveraged to provide you with customized guidance for achieving optimal Atlas performance in your environment.

Evaluation only Atlas Search Head Specifications​

  • An x86 64-bit chip architecture
  • 8 vCPU at 2Ghz or greater speed per core
  • 8GB RAM
  • 100GB of dedicated storage (SSD Based storage system with no less than 800 sustained IOPS, can be thin-provisioned)
  • A 1GB Ethernet NIC
  • A 64-bit Linux or Windows distribution

Minimum Search Head specification from Splunk Documentation​

  • An x86 64-bit chip architecture
  • 16 physical CPU cores, or 32 vCPU at 2Ghz or greater speed per core
  • 12GB RAM
  • Search heads with a high ad-hoc or scheduled search loads should use SSD. An HDD-based storage system must provide no less than 800 sustained IOPS. A search head requires at least 300GB of dedicated storage space.
  • A 1GB Ethernet NIC
  • A 64-bit Linux or Windows distribution

Splunk Version Support​

The selected Atlas Version supports these Splunk Versions:

Splunk Enterprise VersionSupported
9.4.0Yes
9.3.1Yes
9.3.0Yes
9.2.3Yes
9.2.2Yes
9.2.1Yes
9.2.0Yes

Installation Prerequisites​

You should have obtained and completed the following items before proceeding with the installation:

  • A server that meets minimum requirements, has had Splunk installed on it
  • Administrative access to the Atlas Search Head’s Splunk web interface
  • A valid Atlas license key
  • Atlas Application
  • Administrative access to the Atlas Search Head

Atlas Deployments​

There are three supported Deployment Architectures of the Atlas product. This page will outline each of the Deployment Architectures and link to their extended documentation. If Atlas is deployed or utilized utilizing a methodology not described below, certain features may not operate as expected. Please contact Expertise on Demand with any questions.

Standard Deployment​

In the Standard Deployment, Atlas is directly installed on the Search Head tier of the Splunk environment. In a Splunk All In One deployment this is directly on the singular Search Head. In a clustered environment, this is on each Search Head, along with additional TAs installed on the Indexing tier. This deployment gives the greatest functionality and does not require any connection to the internet.

Deployment

Dedicated Deployment​

In the Dedicated Deployment, Atlas is installed on a Splunk Search Head meeting minimum requirements that is not part of the production Search Head cluster, and instead is a Search Peer to it. This is in addition to Atlas TAs being installed on the Indexing tier. This will create an Atlas deployment capable of investigating, and in some cases, interacting with the production Splunk cluster, but will have limited functionality. The benefit of this deployment is that any Atlas use does not impact standard processes on the production cluster, however there is some functionality that can't be performed due to the separated instances. This deployment only requires a connection to the production cluster.

Deployment

Splunk Cloud Deployment​

If you're Splunk Search Head is a Splunk Cloud deployment, then this deployment strategy is necessary. The Splunk Cloud Deployment largely mimics the Dedicated Deployment, with an on-premise Atlas Search Head with a connection to the internet so that it can be a Federated Search Head to your Splunk Cloud deployment. Like the Dedicated Deployment, some functionality will not be enabled due to this separation.

Deployment