Skip to main content
Version: Atlas v3.11

Atlas Requirements

Installation Requirements​

Regardless what what deployment architecture chosen for Atlas, a dedicated Search Head or Search Head cluster is required on your on-premise or in-cloud environment. This Search Head will be referred to as the “Atlas Search Head” throughout the documentation.

Atlas Search Head Sizing Requirements​

The Atlas Search Head should reflect the system resource recommendations for a Splunk Enterprise on-premise search head as provided in Splunk’s Capacity Planning documentation found at this location.

If you are evaluating Atlas, you can consider the following 'Evaluation only' specifications as minimum requirements for the Atlas Search Head. This should provide enough resources to evaluate Atlas features, but as you start adding more users on the Atlas Search Head, you will need to increase the resources accordingly.

Always remember that the Atlas Expertise on Demand Team can be leveraged to provide you with customized guidance for achieving optimal Atlas performance in your environment.

Evaluation only Atlas Search Head Specifications​

  • An x86 64-bit chip architecture
  • 8 vCPU at 2Ghz or greater speed per core
  • 8GB RAM
  • 100GB of dedicated storage (SSD Based storage system with no less than 800 sustained IOPS, can be thin-provisioned)
  • A 1GB Ethernet NIC
  • A 64-bit Linux or Windows distribution

Minimum Search Head specification from Splunk Documentation​

  • An x86 64-bit chip architecture
  • 16 physical CPU cores, or 32 vCPU at 2Ghz or greater speed per core
  • 12GB RAM
  • Search heads with a high ad-hoc or scheduled search loads should use SSD. An HDD-based storage system must provide no less than 800 sustained IOPS. A search head requires at least 300GB of dedicated storage space.
  • A 1GB Ethernet NIC
  • A 64-bit Linux or Windows distribution

Splunk Version Support​

The selected Atlas Version supports these Splunk Versions:

Splunk Enterprise VersionSupportedNotes
9.1.2Supported
9.1.1Supported
9.1.0Supported
9.0.XSupported
8.2.12SupportedSplunk V8 is not supported by Splunk, Atlas will drop V8 Support in Q3 2024

Beginning in Splunk version 9.1.0.1, a subset of the Splunk Web Framework has been deprecated. Atlas is in the process of transitioning to the new framework, but many Atlas Elements still rely upon the Splunk Web Framework. Without Unsupported Hotlinked Imports configured to be Unrestricted, many dashboards will fail to load and will report Javascript errors.

This setting can be changed in the Splunk user interface from the top navigation bar at:

  • Settings > System > Server settings > Internal Library Settings > Unsupported Hotlinked Imports

Turning this setting to Unrestricted will reenable Atlas features. Reach out to Expertise on Demand for any additional guidance.

Installation Prerequisites​

You should have obtained and completed the following items before proceeding with the installation:

  • A server that meets minimum requirements, has had Splunk installed on it
  • Administrative access to the Atlas Search Head’s Splunk web interface
  • A valid Atlas license key
  • Atlas Installer Package
  • Administrative access to the Atlas Search Head
  • Created an “atlas_audit” events index on the Atlas Search Head
  • Created an “atlas_data_utilization” metrics index the Atlas Search Head
  • Created an “atlas_monitor_summary_metrics” metrics index the Atlas Search Head
  • Created an “atlas_stig_metrics” metrics index the Atlas Search Head