Author: W Xi

0 x0 overview

What is Splunk?

Splunk is a powerful machine data analysis platform, including machine data collection, indexing, searching, monitoring, visualization, and alerting. Splunk, on the other hand, is a time series indexer because Splunk indexes data by breaking it into events based on data timestamps.

Splunk collects logs from any IT device and application (servers, routing switches, applications, databases, etc.) for efficient search, indexing, and visualization of logs. Applications: IT operations, security compliance, business analytics, etc.

Overview of Splunk functions

  • Data acquisition:SplunkSupport for various formats (such as XML, JSON) and unstructured machine data acquisition.
  • Data index:SplunkData retrieved from all parties is automatically indexed for searching under a variety of conditions
  • Data search:SplunkThe search in includes patterns for creating metrics or indexes on dashboards.
  • Dashboards: Display search results in pivottables, charts, reports, etc
  • Alarm: Triggers alarm push by email or other means when abnormal activities are found in the analysis data.
  • Splunk has three components:
    • Splunk forwarder: component that collects logs and forwards log data toSplunkIndexer for processing and storage.
    • Splunk indexer: Used to index and store data in forwarders, convert incoming data into events, and store them in indexes for efficient search operations.
    • Splunk search header: Used withSplunkInteractive components. Users are provided with a graphical user interface to perform various operations. Users can search and query data stored in the indexer by entering search terms.
0x1 Splunk installation configuration (toUbuntuAs an example)

Configuration requirements:

  • Ubuntu 20.04 or later
  • 4 gb or above memory
  • 2 cores or higher CPU

Splunk Enterprise Edition download and install

Splunk Enterprise offers a trial installation, which can be downloaded from the official website:

https://www.splunk.com/zh-hans_cn/software/splunk-enterprise.html
Copy the code

Create an account and select the appropriate version to download:

So let’s choose the.deb version.

Then install on the system:

root@osboxes:/tmp# DPKG -i splunk-8.2.2-87344edfcdb4-linux-2.6-amd64.deb Selecting previously unselected package splunk.  (Reading database ... Preparing to Unpack splunk-8.2.2-87344edfcdb4-linux-2.6-amd64.deb 148598 files and directories currently installed.  Unpacking splunk (8.2.2)...Copy the code

After the installation is complete, the default directory is /opt/splunk/ :

Initialize Splunk Settings

root@osboxes:/tmp# cd /opt/splunk/
root@osboxes:/opt/splunk# ./bin/splunk enable boot-start
SPLUNK GENERAL TERMS
Copy the code

Press the space bar to view the software agreement, and press y to agree to the agreement.

Then create Splunk administrator user and password:

Start the Splunk service:

root@osboxes:/opt/splunk# systemctl start splunk
root@osboxes:/opt/splunk# 
Copy the code

If no error message is displayed, the startup is successful. Splunk’s Web UI can now be accessed in a browser using http://serverip:8000

Enter the user name and password to log in to the Web UI.

Now that the Splunk installation is complete, the next step is to add the data

0x3 Splunk Data acquisition

Click Add Data on the Web UI to enter the data adding process. Splunk provides multiple ways to add data:

Here we want to add the host’s log files for monitoring, so select “Monitor – files or ports on this Splunk platform instance” :

Select files and Directories and click browse on the right

Select the log directory and then determine:

Then click next:

Input some Settings, can be set according to the requirements, if there is no problem, you can click “check” :

Success prompt, click “Start search” :

Now that you have successfully added the data to Splunk for indexing, you are ready to search and monitor the log files as needed.

0x4 Splunk Adds Windows log monitoring

First download the universal forwarder from Splunk:

https://www.splunk.com/zh-hans_cn/download.html
Copy the code

Download as required:

Installing a forwarder on a Windows host:

Select data to be collected according to requirements:

Fill in the necessary information as prompted and install

Go back to Splunk’s Web UI and click Settings on the right -> Forward and Receive:

Add a receive setting:

Configure the receive port and save:

Back to search, you can search Windows logs:

0x5 Splunk Adds a dashboard

Click Save as on the right of the search result to create dashboards, reports, and alarms.

Fill in the information and options as required, then click Save:

This creates a dashboard:

More search example can refer to the official document: docs.splunk.com/Documentati…

More dashboard to create and suggest that you can refer to the official document: docs.splunk.com/Documentati…