splunk
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| splunk [2023/12/22 07:34] – [Set-Up Forwarding] baumi | splunk [2024/01/11 09:41] (current) – baumi | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Splunk | + | ====== Splunk |
| - | ===== Install Indexer / Heavy Forwarder | + | ==== Install Indexer / Heavy Forwarder ==== |
| < | < | ||
| sudo useradd -m -d /opt/splunk -s /bin/bash -U splunk && \ | sudo useradd -m -d /opt/splunk -s /bin/bash -U splunk && \ | ||
| Line 9: | Line 9: | ||
| </ | </ | ||
| - | ===== Configure Receiver to receive data ===== | + | ==== Configure Receiver to receive data ==== |
| https:// | https:// | ||
| < | < | ||
| Line 18: | Line 18: | ||
| </ | </ | ||
| - | ===== Set-Up Forwarding | + | ==== Set-Up Forwarding ==== |
| https:// | https:// | ||
| < | < | ||
| Line 32: | Line 32: | ||
| ==== Forward to more than one destinations ==== | ==== Forward to more than one destinations ==== | ||
| / | / | ||
| - | <code> | + | <file text outputs.conf> |
| [tcpout] | [tcpout] | ||
| defaultGroup = group1, | defaultGroup = group1, | ||
| Line 44: | Line 44: | ||
| disabled = false | disabled = false | ||
| server = receiver2: | server = receiver2: | ||
| - | </code> | + | </file> |
| - | ===== Universal Forwarder | + | ==== Universal Forwarder ==== |
| < | < | ||
| useradd -m -d / | useradd -m -d / | ||
| Line 54: | Line 54: | ||
| </ | </ | ||
| - | {{tag> | + | {{tag>kb linux splunk}} |
splunk.1703226880.txt.gz · Last modified: 2023/12/22 07:34 by baumi