Splunk Tutorial- Linux Forwarder & Addon Setup

Download and update Ubuntu 16 server:
releases.ubuntu...
sudo apt-get update
sudo apt-get install openssh-server -y
sudo apt-get upgrade
sudo apt-get dist-upgrade
Start of video:
First thing, we need to make sure Splunk is configured to receive data
Settings - Forwarding and Receiving - Receive Data
Create listening port 9997
Also make sure the local fw is enabled (HomeIDS)
sudo ufw allow 9997
Create new index for linux
Make sure our role can search the index by default
Settings - Access Controls - Roles - instances searched by default
Install Linux Add-on
splunkbase.spl...
Download Splunk forwarder:
www.splunk.com...
www.splunk.com...
sudo dpkg -i splunk_forwarder_package…
sudo /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes
admin / password
sudo ./splunk add forward-server 192.168.0.77:9997
sudo /opt/splunk/bin/splunk enable boot-start
Download the splunk add-on for unix and linux and scp it to the ubuntu machine
sudo tar -zxvf splunk-add-on-...
sudo chown -R splunk:splunk Splunk_TA_nix
sudo mv Splunk_TA_nix /opt/splunkforwarder/etc/apps/
sudo vi /opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/inputs.conf
Enable things and change the intervals
Add index=linux to each
Ps, increase interval
Netstat
Openports
Who
/var/log
Root & user bash history
Restart splunk
Data should be showing up in splunk now.
If you're having an issue with the timezone being UTC, change your users settings:
Settings -Access Controls - Users - Edit USER
-Time Zone

[@edddieee-main-geee-]

Wow. You made this EXTREMELY simple. Just watching you do it made it so much simpler. Thank you!

[@GOTHAM21]

I learned more about splunk from this video than anywhere else I've looked. Including taking splunk fundamentals 1 and 2. I'd like to be able to send you some questions.

[@GOTHAM21]

But you may have answered them. I have to wait till I get back to the SOC and log in to our splunk and check.

[@justinnewman4474]

Great tutorial. This has been helpful setting up splunk as the SIEM for my security lab. Thanks Sqearl!

[@lanceeilers5061]

Very cool stuff there , extremely helpful , thanks a bunch and keep smiling :-)

[@chromefinch]

Dude, again awesome! Thanks so much!

[@indreshchaturvedi1280]

Thanks for this video ..its really awesome.. much appreciated

[@GoodMorningAspirants]

is it possible to install git inside the Splunk Enterprise server of any organisation?/note:Splunk is not installed locally on my system.

[@hermantam6312]

You seem like someone who I could reach out to for help. Currently I am trying to get my Ubuntu instance on VirtualBox to ingest my mac's system logs and performance data as remote logs. However, no logs appear on the Ubuntu instance and I am having great trouble. Any help would be appreciated! You may pm me your contact method. Thanks!

[@DLANM57]

I'm trying to figure out how to use the "clean eventdata" command. I'm getting an error that says my 5000 space limit has been reached. I can find the path to clear space. Setting the limit to 20000 didn't work. I'm unable to use the search function after 4 days of lab practice.