Install Splunk in single-instance mode

This document will guide you through the installation process for a single-instance distributed architecture, recommended for testing and evaluation purposes, or also for small-medium sized environments.

Note

Many of the commands described below need to be executed with root user privileges.

These are the two main components in this type of distributed architecture:

  • The indexer runs the Splunk engine. It reads forwarded data, parses, indexes and stores it as events that contain alert data generated by Wazuh manager sent by the Forwarder instance.

  • The forwarder runs on the Wazuh manager and Wazuh API instance, it reads local data and sends it to the indexer.

Warning

This documentation will install Splunk using the single-instance deployment schema. If you want a more advanced installation, check out the multi-instance deployment schema.

Install Splunk Indexer

This component works receiving the data flow streamed by a forwarder and stores it in a Splunk index.

  1. Download Splunk v7.2.1 package from its official website.

Note

Splunk is not open source software and it requires a registered user and license in order to work. You can also use a free trial license.

  1. Install the Splunk v7.2.1 package:

  1. For RPM based distributions:

# yum install splunk-enterprise-package.rpm

  1. For Debian/Ubuntu distributions:

# dpkg --install splunk-enterprise-package.deb

  1. Ensure Splunk v7.2.1 is installed in /opt/splunk and start the service:

# /opt/splunk/bin/splunk start

Note

You will be prompted for a name and password for the administrator user.

After this step the Splunk Web service will be listening to port 8000. You can browse http://<your-instance-ip>:8000 in order to access the Web GUI.

  1. Optional. If you additionally want the Splunk service to start at boot time, please execute the following command:

# /opt/splunk/bin/splunk enable boot-start

Now that you've finished installing Splunk on a single-instance mode, you can proceed with the next step and install the Wazuh app for Splunk.