Changes will remain in memory only, until you decide to write them. Be careful before using the write command. Device does not contain a recognized partition table Building a new DOS disklabel with disk identifier 0x4d8b4ba7. Command (m for help): n # 新建磁盘分区 Partition type: p primary (0 primary, 0 extended, 4 free) e extended Select (default p): p # 添加主分区 Partition number (1-4, default 1): 1 # 设置分区号 First sector (2048-1048575999, default 2048): # 设置分区起始大小,默认一直回车 Using default value 2048 Last sector, +sectors or +size{K,M,G} (2048-1048575999, default 1048575999): # 设置分区结束大小,默认一直回车
Using default value 1048575999 Partition 1 of type Linux and of size 500 GiB is set
Command (m for help): p # 显示分区信息
Disk /dev/vdc: 536.9 GB, 536870912000 bytes, 1048576000 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk label type: dos Disk identifier: 0x4d8b4ba7
Device Boot Start End Blocks Id System
/dev/vdc1 2048 1048575999 524286976 83 Linux
Command (m for help): w # 保存分区信息并退出 The partition table has been altered! Calling ioctl() to re-read partition table. Syncing disks. [root@splunk-index01 ~]#
查看新区，会生产一个/dev/sdb1的新分区
1
fdisk -l
对新建磁盘分区进行格式化，分区类型为“ext4”
1
mkfs -t ext4 /dev/vdc1
1.3.2.3 挂载vdc磁盘，并设置开机自动挂载
1 2
[root@splunk-index01 ~]# mount /dev/vdc1 /splunk_db # 将/dev/vdc1分区挂载到/splunk_colddb
编辑/etc/fstab文件添加以下内容:
/dev/vdc1 /splunk_db ext4 defaults 0 0
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
[root@splunk-index01 ~]# vim /etc/fstab [root@splunk-index01 ~]# cat /etc/fstab # # /etc/fstab # Created by anaconda on Tue Mar 24 08:18:05 2020 # # Accessible filesystems, by reference, are maintained under '/dev/disk' # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info # /dev/mapper/centos-root / xfs defaults 0 0 UUID=36e55c09-7c6e-4a00-b168-5ffb298638d9 /boot xfs defaults 0 0 /dev/mapper/centos-swap swap swap defaults 0 0 /dev/vdc1 /splunk_db ext4 defaults 0 0 /dev/vdd1 /splunk_colddb ext4 defaults 0 0 [root@splunk-index01 ~]#
Changes will remain in memory only, until you decide to write them. Be careful before using the write command.
Device does not contain a recognized partition table Building a new DOS disklabel with disk identifier 0x4d8b4ba7.
Command (m for help): n # 新建磁盘分区 Partition type: p primary (0 primary, 0 extended, 4 free) e extended Select (default p): p # 添加主分区 Partition number (1-4, default 1): 1 # 设置分区号 First sector (2048-1048575999, default 2048): # 设置分区起始大小,默认一直回车 Using default value 2048 Last sector, +sectors or +size{K,M,G} (2048-1048575999, default 1048575999): # 设置分区结束大小,默认一直回车 Using default value 1048575999 Partition 1 of type Linux and of size 500 GiB is set
Command (m for help): p # 显示分区信息
Disk /dev/vdd: 536.9 GB, 536870912000 bytes, 1048576000 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk label type: dos Disk identifier: 0x4d8b4ba7
Device Boot Start End Blocks Id System
/dev/vdd1 2048 1048575999 524286976 83 Linux
Command (m for help): w # 保存分区信息并退出
The partition table has been altered!
Calling ioctl() to re-read partition table. Syncing disks. [root@splunk-index01 ~]#
查看新区，会生产一个/dev/sdd1的新分区
1
fdisk -l
对新建磁盘分区进行格式化，分区类型为“ext4”
1
$ mkfs -t ext4 /dev/vdd1
1.3.3.3 挂载vdd磁盘，并设置开机自动挂载
1 2
[root@splunk-index01 ~]# mount /dev/vdd1 /splunk_colddb # 将/dev/vdd1分区挂载到/splunk_colddb
if test -f /sys/kernel/mm/transparent_hugepage/enabled; then echo never > /sys/kernel/mm/transparent_hugepage/enabled fi if test -f /sys/kernel/mm/transparent_hugepage/defrag; then echo never > /sys/kernel/mm/transparent_hugepage/defrag fi
This appears to be your first time running this version of Splunk.
Splunk software must create an administrator account during startup. Otherwise, you cannot log in. Create credentials for the administrator account. Characters do not appear on the screen when you type in credentials.
Please enter an administrator username: admin Password must contain at least: * 8 total printable ASCII character(s). # 设置密码 Please enter a new password: Please confirm new password: ---- 省略 ---- All preliminary checks passed.
Starting splunk server daemon (splunkd)... Generating a RSA private key ....+++++ ..........................+++++ writing new private key to 'privKeySecure.pem' ----- Signature ok subject=/CN=splunk_idx01/O=SplunkUser Getting CA Private Key writing RSA key Done [ OK ]
Waiting for web server at http://127.0.0.1:8000 to be available.......... Done
If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com
The Splunk web interface is at http://splunk_idx01:8000
设置开机启动
1 2 3
$ sudo /opt/splunk/bin/splunk enable boot-start --user splunk Init script installed at /etc/init.d/splunk. Init script is configured to run at boot.
