Am I the only one that finds it impossible to follow the SC4S documentation?

[jebron]

I've been trying for the better part of a week to get SC4S up and running into my Splunk server and I just can't do it. I'm not great with Linux and very new to Splunk. The SC4S documentation assumes a HUGE amount of Linux knowledge to comprehend, let alone follow along. I feel stupid and frustrated. I've tried using Docker (which I've never used) and Centos, both of which I couldn't make work and had to start from scratch numerous times. It seems like the perfect solution for the problem I'm trying to solve, but implementing SC4S just seems so out of reach for my current skillset. I really do wish the documentation and installation was more newbie friendly and simple.

I think I'm better off installing an rsyslog server and just monitoring the logs using a UF unfortunately.

[rjha-splunk]

Hi,i will recommend to use podman with centos 8 , the instructions are pretty straightforward.

You can also explore ansible playbooks , it will automatically stand your SC4S server.

Please let us know what issues you face and we will try to improve documentation there.

[rjha-splunk]

Getting started SC4S Layman Guide Podman and Centos 8.pdf
Created a simple guide with Bash script which will do the job.

[jebron]

Wow, this is great. Thank you very much, I appreciate the guide and your time.

Dumb question though, I can only find Centos 9 downloads on their website, where can I get 8?

[rjha-splunk]

It can be downloaded from centos vault http://vault.centos.org/

[jebron]

Oh wow, I got it working! Thank you Rahul!

One question for you, I'm running this in an airgapped environment (no internet access beyond initial installation) it looks like whenever I restart the sc4s daemon/service, it fails to pull down a container image and the startup fails. Is there a straightforward or simple way around this? If so, what changes should I make to the config and/or the installation script to accommodate for this?

[rjha-splunk]

it will be simple as well , just run following bash script:

Create it vi offline_mode.sh
Enter insert mode by pressing i and save it :wq!

#!/bin/bash

# Read user input for the SC4S image tag
read -p "Enter the SC4S image tag used in the previous setup (e.g., latest, 3..0.0): " sc4s_tag

# Tag the image for offline use
sudo podman tag ghcr.io/splunk/splunk-connect-for-syslog/container3:$sc4s_tag sc4slocal:latest

# Update the systemd unit file to use the local image
sudo sed -i 's|ghcr.io/splunk/splunk-connect-for-syslog/container3:[^"]*|sc4slocal:latest|' /lib/systemd/system/sc4s.service
sudo sed -i '/ExecStartPre=\/usr\/bin\/podman pull/d' /lib/systemd/system/sc4s.service

# Reload systemd daemon and restart the SC4S service
sudo systemctl daemon-reload
sudo systemctl restart sc4s

echo "The SC4S service has been configured for offline use with the local image."

Before running it run following
chmod +x offline_mode.sh
./offline_mode.sh

it will change sc4s into offline and will not need internet on restart

[jebron]

Amazing, works great. Thank you! I really appreciate your help, I feel like I'm over a major barrier now and can learn more about SC4S.