Atlas Standard Deployment Instructions

Installation Overview

Atlas will be installed on a Search Head deployed in your local on-premises environment. This Search Head will be referred to as the “Atlas Search Head” throughout this document.

If your Splunk deployment includes a Splunk Cloud environment, the Atlas installation process requires additional steps. Please refer to the installation instructions in Platform Installation (Splunk Cloud) instead of this document.

The Atlas Search Head Deployment Guidelines

• Can be a clustered or non clustered Search Head or an all-in-one (AIO) Splunk deployment
• Meet the Installation Prerequisites

Atlas Installation

This guide will outline the steps required to install the Atlas Platform on your on-premises Atlas Search Head. Getting Atlas up and running will take under two hours. The Atlas Platform comes paired with Expertise on Demand (EoD), and you are encouraged to reach out to EoD for Atlas installation support should you need help.

Atlas Distributed Install Matrix

Use the tables below to determine where and how to install the Atlas Platform. Depending on your environment, your preferences, and the requirements of the add-on, you may need to install Atlas Elements and Technical Add-Ons (TAs) in multiple places.

Atlas Element	Search Heads	Indexers	Heavy Forwarders	Universal Forwarders	Comments
Atlas 4.0	Yes	No	No	No	-
Atlas Assessment	Yes	No	No	No	-
STIG Compliance	Yes	No	No	No	-
STIG Compliance STIG TA	Yes	Yes	Yes	Yes	Install on Index & Search Head Layer to create required Indexes & Data Transformations
STIG Compliance SCAP TA	Yes	Yes	Yes	Yes	Install on Index & Search Head Layer to create required Indexes & Data Transformations

Installing the Atlas Platform on the Search Head

To install Atlas, follow standard Splunk procedure for installing a Splunk Application or TA.

Optional: Configure Distributed Search Groups

Distributed Search Groups (DSGs) enable Atlas users to search data over a specific set of search peers, such as all Search Heads or all Indexers.

DSGs cannot be configured in Splunk Web; the configuration file must be edited directly. Atlas Core comes with a distsearch.conf template to make setting up DSGs as simple as possible. In each stanza, the servers property consists of a comma-delimited list of servers in the following format: https://192.168.1.44:8089,https://192.168.1.62:8089,....

1. Copy the distsearch.conf file in $SPLUNK_HOME/etc/apps/atlas_core/default/ to the /atlas_core/local folder.

2. Edit the /local/distsearch.conf file by uncommenting and filling out each stanza that is relevant to your environment.

   Some of the applicable stanzas may include the following:

   [distributedSearch] - the base stanza

   If any search peers have been added using Splunk Web, this stanza will be populated with a comma-delimited list of these servers in the system-level distsearch.conf file located at $SPLUNK_HOME/etc/system/local/distsearch.conf

   • Copy the servers = entries from the [distributedSearch] stanza in /etc/system/local/distsearch.conf into (under) the same stanza in /etc/apps/atlas_core/local/distsearch.conf

   • Add all of the indexers to the servers list in this stanza. They are listed in the Search Peer page on Splunk Web

   • This stanza should now include all search peers shown in Splunk Web

[distributedSearch:ENV] - DSG for entire environment

This stanza allows the entire environment to be searched at once

• Copy the server list from the base stanza onto this one, adding localhost:localhost to include the Atlas Search Head itself

[distributedSearch:DEF] - DSG to be searched by default

This is the only stanza with default = true

This stanza consists of localhost:localhost as well as all Indexers. This ensures standard search behavior, and prevents search requests from being sent to non-indexers

caution

Note that Indexer Discovery is not currently supported — any newly discovered Indexer Cluster Members will not automatically be added to either the base stanza or the DEF stanza and must be manually added. If you use indexer discovery, and do not care about sending search requests to non-indexers, it is recommended to exclude this group.

caution

• You can add servers into additional groups (stanzas) as needed for your environment. The distsearch.conf template in $SPLUNK_HOME/etc/apps/atlas_core/default contains examples of additional groups you can use if needed.

Remember: Do not edit the distsearch.conf file in the /atlas_core/default/ folder - any changes made there will be overwritten during an upgrade. All edits should be done in the distsearch.conf file in /etc/atlas_core/local.