Fortytwo - Answer to the Ultimate Question of Life, the Universe, and Everything

User Tools

Site Tools

Trace: • vmware-missing-3d-hardware-acceleration • simple-iptables-firwall • ubuntu-xrdp • toggle-mobile-data-rooted • linux-packet-forwarding • splunk-queries
splunk

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
splunk [2023/11/29 16:55] – [Set-Up Forwarding] baumisplunk [2024/01/11 09:41] (current) – baumi
Line 1: Line 1:
-====== Splunk on Linux ======+====== Splunk Installation ======
  
-===== Install Indexer / Heavy Forwarder =====+==== Install Indexer / Heavy Forwarder ====
 <code> <code>
-sudo useradd -m -d /opt/splunk splunk && \ +sudo useradd -m -d /opt/splunk -s /bin/bash -U splunk && \
-sudo chsh -s /bin/bash splunk && \+
 sudo tar xzvf ~/splunk.tgz -C /opt && \ sudo tar xzvf ~/splunk.tgz -C /opt && \
 sudo chown -R splunk:splunk /opt/splunk && \ sudo chown -R splunk:splunk /opt/splunk && \
Line 10: Line 9:
 </code> </code>
  
-===== Configure Receiver to receive data =====+==== Configure Receiver to receive data ====
 https://docs.splunk.com/Documentation/Splunk/9.1.2/Forwarding/Enableareceiver https://docs.splunk.com/Documentation/Splunk/9.1.2/Forwarding/Enableareceiver
 <code> <code>
-sudo su -c "/opt/splunk/bin/splunk enable listen 9997 -auth admin:password+export user=user 
 +export password=password 
 +export port=9997 
 +sudo su -c "/opt/splunk/bin/splunk enable listen ${port} -auth ${user}:${password}" splunk
 </code> </code>
  
-===== Set-Up Forwarding =====+==== Set-Up Forwarding ==== 
 +https://docs.splunk.com/Documentation/Splunk/9.1.2/Forwarding/Deployaheavyforwarder
 <code> <code>
 export user=user export user=user
Line 24: Line 27:
 sudo su -c "/opt/splunk/bin/splunk enable app SplunkForwarder -auth ${user}:${password}" splunk && \ sudo su -c "/opt/splunk/bin/splunk enable app SplunkForwarder -auth ${user}:${password}" splunk && \
 sudo su -c "/opt/splunk/bin/splunk restart" splunk && \ sudo su -c "/opt/splunk/bin/splunk restart" splunk && \
-sudo su -c "splunk add forward-server ${host}:${port} -auth ${user}:${password} && \+sudo su -c "splunk add forward-server ${host}:${port} -auth ${user}:${password}" splunk && \
 sudo su -c "/opt/splunk/bin/splunk restart" splunk sudo su -c "/opt/splunk/bin/splunk restart" splunk
 </code> </code>
 +==== Forward to more than one destinations ====
 +/opt/splunk/etc/system/local/outputs.conf
 +<file text outputs.conf>
 +[tcpout]
 +defaultGroup = group1,group2
 +indexAndForward = 0
 +
 +[tcpout:group1]
 +disabled = false
 +server = receiver1:9997
 +
 +[tcpout:group2]
 +disabled = false
 +server = receiver2:9997
 +</file>
  
-===== Universal Forwarder =====+==== Universal Forwarder ====
 <code> <code>
-useradd -m -d /opt/splunkforwarder splunkfwd && \ +useradd -m -d /opt/splunkforwarder -s /bin/bash -U splunkfwd && \
-chsh -s /bin/bash splunkfwd && \+
 sudo tar xzvf ~/splunk-forwarder.tgz -C /opt && \ sudo tar xzvf ~/splunk-forwarder.tgz -C /opt && \
 sudo chown -R splunkfwd:splunkfwd /opt/splunkforwarder && \ sudo chown -R splunkfwd:splunkfwd /opt/splunkforwarder && \
Line 37: Line 54:
 </code> </code>
  
-{{tag>linux splunk}}+{{tag>kb linux splunk}}
splunk.1701273313.txt.gz · Last modified: 2023/11/29 16:55 by baumi
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki