README.md

Kernel Optimizations Overview and Purpose

The splunk-kernel role, runs against members of the specified inventory to configure Splunk server optimizations.

This role is used to validate the system is in the desired state and is safe to run in an ad-hoc manner.

Running this playbook is only required if no other process exists to manage the defined optimizations.

Server optimizations:
Setting swappiness, ulimits, and disabling transparent-hugepages for each node.

Splunk Kernel Role Objectives

Optimize server settings by setting default kernel configuration parameters

1. Configure the Splunk Nodes after splunk-kernel role has run
   1. Set configuration options to allow proper operation of a Splunk Cluster

The playbook will configure:

• Setup server optimizations on Splunk servers
  • kernel
    • splunk-kernel : Disable transparent huge pages via a service
    • splunk-kernel : Set swappiness to 10 in /etc/sysctl.conf
    • splunk-kernel : Set ulimits for splunk user

Files included in this role:

splunk-kernel/
├── README.md
├── files
│   ├── disable-transparent-hugepages.init
│   └── disable-transparent-hugepages.service
├── handlers
│   └── main.yml
└── tasks
    └── main.yml

How does this work?

Once splunk-kernel has been applied, nodes can be configured for individual capabilities based on their inventory group.
The inventory is based on the hosts.example file located within the playbook.
However, inventory can be managed in other ways.