Man opening a magical box

Splunk n’ a Box: Need a Lab or Test Environment NOW? There’s an App for That!

While attending the second week of the two-week Splunk Certified Consultant 2 (SCC2) training program, I was fortunate enough to have a conversation with one of the other attendees.  The nugget I gleaned from the conversation was about a project called Splunk n’ a Box, and it’s *free*.

As any curious consultant would, I had a look at it and all I can say is wow, what a cool idea.  This article will discuss what Splunk n’ a Box is, where to get it and explore ways to use it.

What is Splunk n’ a Box?

What is it? Splunk n’ a Box is a 6000+ line bash script that one can use to provide an entire Splunk lab environment in a matter of minutes. It is deployed using Docker, a tool that easily creates, deploys, and runs an application by packaging up all the parts it needs and shipping them out as a single package. From a professional services point of view, this is awesome since I can create a Splunk lab environment to match most client production environments.

If you’ve never heard of Splunk n’ a Box you may be thinking “Yeah, right”…

It’s true! You can provision Search Head Clusters, Indexing Clusters, Splunk-to-Splunk instances, and pretty much any other kind of Splunk instance you can come up with – no $100k+ hardware price tag required…The environments can be run on a variety of platforms, Mac OSx, Windows 10, Linux (Ubuntu), and AWS EC2.

Welcome to Splunk in a box view

Here is a sample hardware scenario from the author of Splunk n’ a Box (Mohamad Hassan):

“I was able to create 80 hosts (4 site-2-site cluster 20IDX 3SH each) on a single Intel NUC Skull device (i7 32GB 1TB SSD). Load Avg shot to 20 during the build but went down to 6 once the cluster stabilized.”

By the way,  A BIG thank you Mohamad!!  This is awesome. A few clarifications:

1. What is an NUC?

Answer:  Next Unit of Computing (NUC). NUC is a small-form-factor personal computer designed by Intel.

2. Can I install and run this on a USB stick?

Answer: You sure can! The directions to install on a USB drive are here.

What happens behind the scenes with Splunk n’ a Box?

Behind the scenes (very condensed synopsis, see the Splunk n’ a Box site for all the details):

No manual Splunk installation or manual clustering commands are needed to spin up these environments.  One can spin up a Docker image running specific configurations by simply selecting a menu option.

The following table describes the build environments versus the typical number of commands to complete the task and the time to complete the build.

Cluster environment specs
IDX: Indexer
SH: Search Head
DS: Deployment Server
LM: License Master
CM: Cluster Master
DEP: Search Head Cluster Deployer
HF: Heavy Forwarder
UF: Universal Forwarder
DMC: Distributed Management Console (Splunk 6.5 name changed to Monitoring Console)

Okay, I’m Going to Try This!!

My first time firing up the script was flawless. I now had an “All in One” Splunk instance in under 10 minutes from install to up and running.

This is great. I can now test any data ingestion, upgrade, or whatever scenario I require right on my own laptop.  I can even share the environment if I install it on Linux (Ubuntu preferred), and on an AWS EC2 instance for a larger sustainable Lab for a classroom or a lunch and learn.

Ok, looks good so far…

Splunk in a box config page

Logged in and voila, I have a brand new Splunk test machine! Nice!

Splunk Launcher page

Cool! Now that the environment is up and running, I want to get to the underlying Splunk configurations in order to install Splunk technology add-ons (TAs), applications, custom parsing for log ingestion, etc.

Here’s how:

Start docker in the terminal

Time to go play with my new toy! (and remember, it’s free)

About SP6

SP6 is a Splunk consulting firm focused on Splunk professional services including Splunk deployment, ongoing Splunk administration, and Splunk development. SP6 has a separate division that also offers Splunk recruitment and the placement of Splunk professionals into direct-hire (FTE) roles for those companies that may require assistance with acquiring their own full-time staff, given the challenge that currently exists in the market today.