Usually, you’ll use the Splunk Operator to run Splunk on K8S. There are some use cases where you might want to run Splunk without the operator though.

As with any deployment, it’s good practice then to add liveness probes to restart Splunk if it’s not healthy anymore.

Furthermore, as the Splunk container needs about one minute to startup, I’ll recommend adding a readiness probe. This ensures that no traffic is sent to a pod as long as Splunk hasn’t been fully started yet. Also, it won’t terminate older instances on an update if the new instances are not ready yet.

Here’s how it’s done: