Topics Map > Security > Event Logging > Splunk

How can I install Splunk universal forwarder on Linux?

Linux Install: Should be done as root.
Download installation files from: https://uofi.box.com/v/splunk

Adapted from:
https://docs.splunk.com/Documentation/Forwarder/8.0.2/Forwarder/Installanixuniversalforwarder

Create the and configure the splunk user account

  1. adduser splunk 
  2. usermod -aG wheel splunk
  3. passwd splunk  <== not necessary, unless you wish to directly login as splunk rather than escalate privileges

Download and install Splunk forwarder

  1. cd /opt/
  2. wget -O splunkforwarder-8.0.2.1-f002026bad55-Linux-x86_64.tgz 'https://www.splunk.com/page/download_track?file=8.0.2.1/linux/splunkforwarder-8.0.2.1-f002026bad55-Linux-x86_64.tgz&ac=&wget=true&name=wget&platform=Linux&architecture=x86_64&version=8.0.2.1&product=universalforwarder&typed=release'
  3. tar xvzf splunkforwarder-8.0.2.1-f002026bad55-Linux-x86_64.tgz -C /opt/
  4. chown -R splunk:splunk splunkforwarder
  5. setfacl -m "u:splunk:r-x" /var/log
  6. setfacl -m "u:splunk:r--" /var/log/*
  7. setfacl -m d:user:splunk:r /var/log
  8. su - splunk
  9. /opt/splunkforwarder/bin/splunk start --accept-license

Output:

 
This appears to be your first time running this version of Splunk.

Create credentials for the administrator account.
Characters do not appear on the screen when you type the password.
Password must contain at least:
   * 8 total printable ASCII characters(s).
Please enter a new password:   <== password is independent of the splunk account password.

After verifying installation was successful, enable boot start, again as root. 

1. /opt/splunkforwarder/bin/splunk stop
2. /opt/splunkforwarder/bin/splunk enable boot-start -user splunk      

Output:


Init script installed at /etc/init.d/splunk.
Init script is configured to run at boot.

Install UIC Splunk deployment client app:

  1. Visit https://uofi.box.com/v/splunk
  2. Transfer UIC_ALL_deploymentclient folder to /opt/splunkforwarder/etc/apps/
  3. chown -R splunk:splunk /opt/splunkforwarder
  4. /opt/splunkforwarder/bin/splunk start

Verify service is running as splunk user:

  1. ps -ef | grep splunk

Configure Firewall Rules

Open firewall ports for splunk 8089/tcp to splunk-deployment.server.uic.edu (131.193.68.94) and indexer-sas.splunk.uic.edu (indexer.cc.uic.edu) (128.248.155.23).



Keywords:splunkforwarder, installation files, Tar file installation   Doc ID:86156
Owner:Esteban P.Group:University of Illinois at Chicago ACCC
Created:2018-10-01 11:07 CDTUpdated:2020-05-28 18:03 CDT
Sites:University of Illinois at Chicago ACCC
Feedback:  1   0