Install Splunk in an all-in-one architecture

This document will guide you through the installation process for an all-in-one Wazuh Splunk server.

Note

Most of the commands described below need to be executed with root user privileges.

These are the two main components in this type of multi-tier server:

  • The indexer runs the Splunk engine. It reads forwarded data, parses, indexes and stores it as events that contain alert data generated by the Wazuh manager and sent by the Forwarder instance.

  • The forwarder reads local data from the Wazuh manager and the Wazuh API instance and sends this data to the indexer.

Warning

This section will install Splunk using the all-in-one deployment schema typically suitable for testing. Other installation options are:

Install and configure Splunk indexer

This component receives the data flow streamed by a forwarder and stores it in a Splunk index.

  1. Download the Splunk package from its official website. The versions of Splunk compatible with Wazuh and the Wazuh app for Splunk can be found here.

    Note

    • Splunk is not open source software, and it requires a registered user and license in order to work. You can also use a free trial license.

    • This guide will install and configure Splunk 8.2.6. If you intend to configure a different version of Splunk with Wazuh, change the Splunk version number in the requests for the configuration files and the Wazuh app for Splunk. For example, if you intend to configure Splunk 8.2.2:

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/indexes.conf
      

      Becomes

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.2/setup/indexer/indexes.conf
      
  2. Install the Splunk package:

    1. For RPM based distributions:

      # yum install splunk-enterprise-package.rpm
      
    2. For Debian/Ubuntu distributions:

      # dpkg --install splunk-enterprise-package.deb
      
  3. Configure inputs.conf and indexes.conf:

    1. Create indexes.conf:

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/indexes.conf
      
    2. Create inputs.conf:

      # curl -so /opt/splunk/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/inputs.conf
      
  4. Ensure Splunk is installed in /opt/splunk and start the service:

    # /opt/splunk/bin/splunk start
    

    Note

    This command will make a Splunk General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

Set up data forwarding

  1. Edit /opt/splunk/etc/system/local/inputs.conf and add the block below:

    [SSL]
    serverCert = $SPLUNK_HOME/etc/auth/server.pem
    sslPassword = password
    

    Where:

    • serverCert is the path to the Splunk default server certificate.

    • $SPLUNK_HOME is the Splunk installation directory. The default directory is /opt/splunk.

    • sslPassword is the password of the certificate. The default is “password”.

  2. Restart the Splunk service:

    # /opt/splunk/bin/splunk restart
    
  3. Optional. If you additionally want the Splunk service to start at boot time, please execute the following command:

    # /opt/splunk/bin/splunk enable boot-start
    
  1. Open Splunk in your preferred browser.

  2. Navigate to Settings > Data > Forwarding and receiving.

  3. Select “Configure receiving”

  4. Add an unused port as a new receiving port and save it.

  5. Restart the Splunk service.

    # /opt/splunk/bin/splunk restart
    
  6. Optional. If you additionally want the Splunk service to start at boot time, please execute the following command:

    # /opt/splunk/bin/splunk enable boot-start
    

Install and configure Splunk forwarder

A Splunk forwarder is required in order to send alerts to the Splunk indexer.

Depending on the type of architecture that you’re installing, the Splunk forwarder is configured differently.

  1. Download the Splunk forwarder package from the official website. The versions of Splunk forwarder compatible with Wazuh and the Wazuh app for Splunk can be found here.

    Note

    • Splunk is not open source software, and it requires a registered user and license in order to work. You can also use a free trial license.

    • This guide will install and configure Splunk 8.2.6. If you intend to configure a different version of Splunk with Wazuh, change the Splunk version number in the requests for the configuration files and the Wazuh app for Splunk. For example, if you intend to configure Splunk 8.2.2:

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/indexes.conf
      

      Becomes

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.2/setup/indexer/indexes.conf
      
  2. Install the Splunk forwarder package on the Wazuh manager:

    # yum install splunkforwarder-package.rpm
    
    # dpkg --install splunkforwarder-package.deb
    

Configuration

This section explains how to configure the Splunk forwarder to send alerts to the Splunk indexer component.

  • props.conf: In order to consume data inputs, Splunk needs to specify what kind of format it will handle. The props.conf file specifies the data format Splunk can handle.

  • inputs.conf: The Splunk forwarder needs this file to read data from an input. In this case, the Wazuh alerts file.

Creating the configuration files

  1. Download and insert the props.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/props.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/forwarder/props.conf
    
  2. Download and insert the inputs.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/forwarder/inputs.conf
    
  3. Set the Wazuh manager hostname:

    # sed -i "s:MANAGER_HOSTNAME:$(hostname):g" /opt/splunkforwarder/etc/system/local/inputs.conf
    

Set up data forwarding

  1. Create the file outputs.conf:

    # touch /opt/splunkforwarder/etc/system/local/outputs.conf
    
  2. Fill it with the content below:

    [tcpout]
    defaultGroup = default-autolb-group
    
    [tcpout:default-autolb-group]
    server = <INDEXER_IP>:9997
    clientCert = /opt/splunkforwarder/etc/auth/server.pem
    sslRootCAPath = /opt/splunkforwarder/etc/auth/ca.pem
    sslPassword = password
    
    [tcpout-server://<INDEXER_IP>:9997]
    
    • INDEXER_IP is the IP address of the Splunk indexer.

  3. Start the Splunk forwarder service:

    # /opt/splunkforwarder/bin/splunk start
    

    Note

    This command will make a Splunk forwarder General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

    Warning

    If you get an error message about port 8089 already being in use, you can change it to use a different one.

    After installing the Splunk forwarder, incoming data should appear in the designated Indexer.

  4. Optional. If you want the Splunk forwarder service to start at boot time, please execute the following command:

    # /opt/splunkforwarder/bin/splunk enable boot-start
    
  1. Start the Splunk forwarder:

    # /opt/splunkforwarder/bin/splunk start
    

    Note

    This command will make a Splunk forwarder General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

    Warning

    If you get an error message about port 8089 already being in use, you will be prompted to change it to use a different one.

  2. Point the Splunk forwarder output to Wazuh Splunk indexer with the following command:

    # /opt/splunkforwarder/bin/splunk add forward-server <INDEXER_IP>:<INDEXER_PORT>
    

    This command will prompt for the Splunk indexer username and password.

    • INDEXER_IP is the IP address of the Splunk Indexer.

    • INDEXER_PORT is the port of the Splunk indexer earlier configured in receiving. The default value is 9997.

  3. Restart the Splunk Forwarder service:

    # /opt/splunkforwarder/bin/splunk restart
    

    Warning

    If you get an error message about port 8089 already being in use, you can change it to use a different one.

    After installing the Splunk Forwarder, incoming data should appear in the designated Indexer.

  4. Optional. If you additionally want the Splunk forwarder service to start at boot time, please execute the following command:

    # /opt/splunkforwarder/bin/splunk enable boot-start
    

Now that you’ve finished installing Splunk using the all-in-one architecture, you can proceed with the next step and install the Wazuh app for Splunk.