forked from lerndevops/labs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
installSplunk.txt
executable file
·56 lines (41 loc) · 2.66 KB
/
installSplunk.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
Splunk Enterprise Server installation
Cent OS
-------
cd /tmp ; wget -O splunk-7.2.6-c0bf0f679ce9-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.2.6&product=splunk&filename=splunk-7.2.6-c0bf0f679ce9-linux-2.6-x86_64.rpm&wget=true'
rpm -i /tmp/splunk-7.2.6-c0bf0f679ce9-linux-2.6-x86_64.rpm
/opt/splunk/bin/splunk start --accept-license ( enter username & password )
Ubuntu
-------
cd /tmp ; wget -O splunk-7.2.6-c0bf0f679ce9-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.2.6&product=splunk&filename=splunk-7.2.6-c0bf0f679ce9-linux-2.6-amd64.deb&wget=true'
dpkg -i /tmp/splunk-7.2.6-c0bf0f679ce9-linux-2.6-amd64.deb
/opt/splunk/bin/splunk start --accept-license ( enter username & password )
============================================================================================================
Splunk Forwarder Installation
Cent OS
-------
cd /tmp ; wget -O splunkforwarder-7.2.6-c0bf0f679ce9-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.2.6&product=universalforwarder&filename=splunkforwarder-7.2.6-c0bf0f679ce9-linux-2.6-x86_64.rpm&wget=true'
rpm -i /tmp/splunkforwarder-7.2.6-c0bf0f679ce9-linux-2.6-x86_64.rpm
/opt/splunkforwarder/bin/splunk start --accept-license ( enter username & password )
Ubuntu
--------
cd /tmp ; wget -O splunkforwarder-7.2.6-c0bf0f679ce9-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.2.6&product=universalforwarder&filename=splunkforwarder-7.2.6-c0bf0f679ce9-linux-2.6-amd64.deb&wget=true'
dpkg -i /tmp/splunkforwarder-7.2.6-c0bf0f679ce9-linux-2.6-amd64.deb
/opt/splunkforwarder/bin/splunk start --accept-license ( enter username & password )
============================================================================================================
cofigure mail server
settings ==> Server settings ==> Email Setting
Mail host: smtp.gmail.com
Email security: Enable SSL
Username: your gmail
Password: your gmail passwd
Save
============================================================================================================
Create Alert
serach for data
index="apachelogs" sourcetype="nginx" 404 ==> Save As ==> Alert ( under setting )
Title: 404-Alert
Permission: Shared in App
Alert type: Scheduled/Real Time
Trigger Conditions: choose accordinlgy
Throttle: choose if required ( after an alert is triggered, subsequent alerts will not be triggered until after the throttle period )
Trigger Actions: send Email