About Me

My photo
Kalyan Kumar Pasupuleti B-Tech(Information Technology). • AWS Certified Solutions Architect - Associate • RedHat Certified Engineer(RHCE) • Directory Services and Authentication Certificate of Expertise(LDAP) • Red Hat SELinux Policy Administration Certificate of Expertise(SELinux) • Network Services Security Certificate of Expertise (Network Services) • RedHat Certified Virtualization Administrator(RHCVA) • Red Hat Certified Security Specialist (RHCSS) Working as Cloud DevOps engineer

Monday, April 1, 2019

How to install Splunk on centos7

What is Splunk?
Splunk is a software technology which provides the engine for monitoring, searching, analyzing, visualizing and acting on voluminous streams of real-time machine data.

Download Splunk

  1. Browse https://www.splunk.com/
  2. On the top right corner click on "Free Splunk"
  3. Create your account/login using your existing account
  4. Click on "Download Free 60-Day Trial" in "Splunk Enterprise" section
  5. Click on "Linux" tab
  6. Download '.tgz' tar ball
Install Splunk

  1. Login to the linux box where you downloaded the tar ball.
  2. Add a splunk group 
    • # groupadd splunk
  3. Add splunk user along with home directory and group as shown below command.
    • # useradd -d /opt/splunk -m -g splunk splunk
  4. Change to splunk user and check the id
    • # su - splunk
    • $ id
    • uid=1001(splunk) gid=1001(splunk) groups=1001(splunk)
Extract the tar ball

  1. # tar -xvf splunk-*.tgz
  2. Copy the splunk directory content to /opt/splunk/
    • # cp -rp splunk/* /opt/splunk/
  3. Make sure /opt/splunk/ and its content owned by splunk user
    • # chown -R splunk: /opt/splunk/
Installation:

  1. Switch to splunk user
    • # su - splunk
  2. Change directory to bin
    • $ cd bin
  3. Start splunk
    • $ ./splunk start --accept-license
  4. Enter the splunk admin username and password for GUI login
  5. By the end of start command you can see your web server details (ex: <your webserver hostname/ip:8000>)
  6. Now browse the web server
    • Ex: http://192.168.1.105:8000
  7. Loging using splunk admin user and password you created during splunk start.
Thats it!.