This document will guide you through the simple distributed architecture installation process according to the previous page schema.
Many of the commands described below need to be executed with root user privileges.
Splunk Indexer installation
This component works receiving the data flow streamed by a Forwarder and stores it in a Splunk index.
Download Splunk v7.1.1 package from its official website.
Splunk is not open source software and it requires a registered user and license to work. You can also use a free trial license.
Install the Splunk v7.1.1 package:
For RPM based distributions:# yum install splunk-enterprise-package.rpm
For Debian/Ubuntu distributions:# dpkg --install splunk-enterprise-package.deb
Ensure Splunk v7.1.1 is installed in
/opt/splunkand start the service:
# /opt/splunk/bin/splunk start
You will be prompted for a password for the 'admin' user.
After this step the Splunk Web service will be listening to port 8000. You can browse
http://<your-instance-ip>:8000in order to access the Web GUI.
Optional. If you additionally want Splunk service to start at boot time, please execute the following command:
# /opt/splunk/bin/splunk enable boot-start
Splunk Forwarder installation
A Forwarder is required in order to send alerts to the Indexer. This component will be installed in the manager instance.
Download Splunk Forwarder v7.1.1 package from the official website.
Install it with the following command depending on your operating system:
For RPM based distributions:# yum install splunkforwarder-package.rpm
For Debian/Ubuntu distributions:# dpkg --install splunkforwarder-package.deb
Ensure Splunk Forwarder v7.1.1 is installed in
Useful Splunk CLI commands can be found in the Splunk official documentation .
Now that you've finished installing Splunk, you can proceed with the Splunk app for Wazuh installation.