Installing Atlas

Atlas Requirements

Regardless of the deployment architecture, Atlas requires a dedicated Search Head or Search Head cluster in your on-premises or cloud environment. This Search Head is referred to throughout this documentation as the Atlas Search Head.

Atlas Search Head Sizing Requirements

The Atlas Search Head should meet the Splunk Enterprise search head resource recommendations in Splunk's Capacity Planning documentation.

For an Atlas evaluation, use the following minimum specifications. Increase resources as you add users and expand Atlas usage.

Evaluation Atlas Search Head Specifications

• An x86 64-bit chip architecture
• 8 vCPU at 2 GHz or greater speed per core
• 8 GB RAM
• 100 GB of dedicated storage on an SSD-based storage system with no less than 800 sustained IOPS
• A 1 GB Ethernet NIC
• A 64-bit Linux or Windows distribution

Minimum Search Head Specifications from Splunk Documentation

• An x86 64-bit chip architecture
• 16 physical CPU cores, or 32 vCPU at 2 GHz or greater speed per core
• 12 GB RAM
• At least 300 GB of dedicated storage; search heads with high ad hoc or scheduled search loads should use SSD storage
• A 1 GB Ethernet NIC
• A 64-bit Linux or Windows distribution

Splunk Version Support

Refer to the Atlas Splunkbase listing for current Splunk version support.

Installation Prerequisites

Before installing Atlas, ensure that you have:

• A server that meets the minimum requirements and has Splunk installed
• The Atlas application package or access to its Splunkbase listing
• Administrative access to the Atlas Search Head's Splunk web interface
• Administrative access to the Atlas Search Head

Install Atlas

Atlas can be installed using either of the following methods:

1. Install from Splunkbase: Download and install Atlas from Splunkbase. Splunk Cloud environments must download Atlas from Splunkbase.
2. Download and install manually: Download the Atlas installation package using Downloading Atlas, then follow the standard Splunk procedure for installing an app.

If you use STIG Compliance, also download the required technical add-ons as described in Downloading Atlas.

Deployment Architectures

Standard Deployment

Use a Standard Deployment when installing Atlas directly in Splunk Cloud or on the Search Head tier of an on-premises environment where you have access to install apps. In a Splunk All In One deployment, install Atlas on the single Search Head. In a clustered environment, install Atlas on each Search Head.

The Atlas Search Head can be a clustered or non-clustered Search Head, or an all-in-one Splunk deployment.

Dedicated Deployment

In a Dedicated Deployment, Atlas is installed on a Search Head that meets the minimum requirements but is not part of the production Search Head cluster. Configure the Atlas Search Head as a Search Peer to the production environment. This deployment can investigate and, in some cases, interact with the production cluster, but some functionality is limited because Atlas runs separately from the production Search Head tier.

The Atlas Dedicated Search Head can be a clustered or non-clustered Search Head, or an all-in-one Splunk deployment. It must be able to connect to the remote Splunk environment over the internet or local network.

Dedicated Deployment Feature Restrictions

In a Dedicated Deployment, modifying searches on the remote environment requires Atlas Targets.

Configure the Dedicated Atlas Search Head and REST Connections

After installing and configuring the Dedicated Atlas Search Head, connect it to the remote Splunk environment. These steps ensure that the Atlas Search Head can search the required remote Search Heads and Indexers.

1. Configure Federated Search on the Atlas Search Head
   • Create an account on the remote Splunk instance with the fsh_manage permission.
   • In Splunk Web on the Atlas Search Head, navigate to Settings > Federated Search > Add Federated Provider.
   • Create a Federated Provider in transparent mode using the remote Splunk URI and the account created above.
   • Review the Splunk federated search documentation for additional information.
2. Add remote Search Heads as search peers
   • In Splunk Web on the Atlas Search Head, navigate to Settings > Distributed Search > Search Peers.
   • Use New Search Peer to add the Splunk instances that Atlas must search or perform REST calls against.
   • Search Heads added as peers must be the same or a later Splunk version than their search peers.

Component Installation Matrix

Use this table to determine where to install Atlas and its STIG Compliance components.

Component	Standard Deployment	Dedicated Deployment
Atlas v5	Install on each Atlas Search Head	Install on the Dedicated Atlas Search Head
STIG Compliance	Install on each Atlas Search Head	Install on the Dedicated Atlas Search Head
STIG Compliance STIG TA and SCAP TA	Install on the Search Head, Indexer, Heavy Forwarder, and Universal Forwarder tiers	Install on the Dedicated Atlas Search Head, remote Indexers, and Heavy Forwarders

Optional: Configure Distributed Search Groups

Distributed Search Groups enable Atlas users to search a specific set of search peers, such as all Search Heads or all Indexers.

Distributed Search Groups cannot be configured in Splunk Web; edit the configuration file directly. Atlas includes a distsearch.conf template at $SPLUNK_HOME/etc/apps/atlas_core/default/. In each stanza, the servers property is a comma-delimited list of servers in this format: https://192.168.1.44:8089,https://192.168.1.62:8089,....

1. Copy distsearch.conf from $SPLUNK_HOME/etc/apps/atlas_core/default/ to $SPLUNK_HOME/etc/apps/atlas_core/local/.
2. Edit $SPLUNK_HOME/etc/apps/atlas_core/local/distsearch.conf and uncomment or complete the stanzas that apply to your environment.

Common stanzas include:

• [distributedSearch]: The base stanza. Copy the servers = entries from $SPLUNK_HOME/etc/system/local/distsearch.conf, then add the indexers shown on the Splunk Web Search Peers page.
• [distributedSearch:ENV]: A Distributed Search Group for the entire environment. Copy the base server list and add localhost:localhost to include the Atlas Search Head.
• [distributedSearch:DEF]: The default Distributed Search Group. Include localhost:localhost and all Indexers to preserve standard search behavior and avoid sending search requests to non-indexers.

caution

Indexer Discovery is not currently supported. Newly discovered Indexer Cluster Members are not automatically added to the base or default stanza and must be added manually.

You can add additional groups as needed. Do not edit distsearch.conf in the default directory; upgrades overwrite that directory. Make all changes in the local directory.