Install Splunk in an all-in-one architecture

This document will guide you through the installation process for an all-in-one Wazuh Splunk server.

Note

You need root user privileges to run all the commands described below.

These are the two main components in this type of multi-tier server:

  • The indexer runs the Splunk engine. It reads forwarded data, parses, indexes and stores it as events that contain alert data generated by the Wazuh manager and sent by the Forwarder instance.

  • The forwarder reads local data from the Wazuh manager and the Wazuh API instance and sends this data to the indexer.

Note

  • Splunk is not open source software, and it requires a registered user and license in order to work. You can also use a free trial license.

  • This guide installs and configures Splunk 8.2. If you intend to configure another version of Splunk, such as 8.1, change the Splunk version number in the requests for the configuration files and the Wazuh app for Splunk. For example:

    # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.4.5-8.2/setup/indexer/indexes.conf
    

    Becomes

    # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.4.5-8.1/setup/indexer/indexes.conf
    

Warning

This section will install Splunk using the all-in-one deployment schema typically suitable for testing. Other installation options are:

Install and configure Splunk indexer

This component receives the data flow streamed by a forwarder and stores it in a Splunk index.

  1. Download the Splunk package from its official website. The versions of Splunk compatible with Wazuh and the Wazuh app for Splunk can be found here.

  2. Install the Splunk package:

    1. For RPM based distributions:

      # yum install splunk-enterprise-package.rpm
      
    2. For Debian/Ubuntu distributions:

      # dpkg --install splunk-enterprise-package.deb
      
  3. Configure inputs.conf and indexes.conf:

    1. Create indexes.conf:

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.4.5-8.2/setup/indexer/indexes.conf
      
    2. Create inputs.conf:

      # curl -so /opt/splunk/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.4.5-8.2/setup/indexer/inputs.conf
      
  4. Ensure Splunk is installed in /opt/splunk and start the service:

    # /opt/splunk/bin/splunk start
    

    Note

    This command will make a Splunk General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

Set up data forwarding

  1. Edit /opt/splunk/etc/system/local/inputs.conf and add the block below:

    [SSL]
    serverCert = $SPLUNK_HOME/etc/auth/server.pem
    sslPassword = password
    

    Where:

    • serverCert is the path to the Splunk default server certificate.

    • $SPLUNK_HOME is the Splunk installation directory. The default directory is /opt/splunk.

    • sslPassword is the password of the certificate. The default is “password”.

  2. Restart the Splunk service:

    # /opt/splunk/bin/splunk restart
    
  3. Optional. If you additionally want the Splunk service to start at boot time, please execute the following command:

    # /opt/splunk/bin/splunk enable boot-start
    

Install and configure Splunk forwarder

A Splunk forwarder is required in order to send alerts to the Splunk indexer.

Depending on the type of architecture that you’re installing, the Splunk forwarder is configured differently.

  1. Download the Splunk forwarder package from the official website. The versions of Splunk forwarder compatible with Wazuh and the Wazuh app for Splunk can be found here.

  2. Install the Splunk forwarder package on the Wazuh manager:

    # yum install splunkforwarder-package.rpm
    

Configuration

This section explains how to configure the Splunk forwarder to send alerts to the Splunk indexer component.

  • props.conf: In order to consume data inputs, Splunk needs to specify what kind of format it will handle. The props.conf file specifies the data format Splunk can handle.

  • inputs.conf: The Splunk forwarder needs this file to read data from an input. In this case, the Wazuh alerts file.

Creating the configuration files

  1. Download and insert the props.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/props.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.4.5-8.2/setup/forwarder/props.conf
    
  2. Download and insert the inputs.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.4.5-8.2/setup/forwarder/inputs.conf
    
  3. Set the Wazuh manager hostname:

    # sed -i "s:MANAGER_HOSTNAME:$(hostname):g" /opt/splunkforwarder/etc/system/local/inputs.conf
    

Set up data forwarding

  1. Create the file outputs.conf:

    # touch /opt/splunkforwarder/etc/system/local/outputs.conf
    
  2. Fill it with the content below:

       [tcpout]
       defaultGroup = default-autolb-group
    
       [tcpout:default-autolb-group]
       server = <INDEXER_IP>:9997
       clientCert = /opt/splunkforwarder/etc/auth/server.pem
       sslRootCAPath = /opt/splunkforwarder/etc/auth/ca.pem
       sslPassword = password
    
       [tcpout-server://<INDEXER_IP>:9997]
    
    • <INDEXER_IP> is the IP address of the Splunk indexer.

  3. Start the Splunk forwarder service:

    # /opt/splunkforwarder/bin/splunk start
    

    Note

    This command will make a Splunk forwarder General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

    Warning

    If you get an error message about port 8089 already being in use, you can change it to use a different one.

    After installing the Splunk forwarder, incoming data should appear in the designated Indexer.

  4. Optional. If you want the Splunk forwarder service to start at boot time, please execute the following command:

    # /opt/splunkforwarder/bin/splunk enable boot-start
    

Now that you’ve finished installing Splunk using the all-in-one architecture, you can proceed with the next step and install the Wazuh app for Splunk.