Install a minimal Splunk distributed architecture

This document will guide you through the installation process for a multi-tier server.

Note

Most of the commands described below need to be executed with root user privileges.

These are the two main components in this type of multi-tier server:

  • The indexer runs the Splunk engine and is run on a different server from the Wazuh server. It reads forwarded data, parses, indexes and stores it as events that contain alert data generated by the Wazuh manager and sent by the Forwarder instance.

  • The forwarder runs on the Wazuh manager and the Wazuh API instance. It reads local data and sends it to the indexer.

Prerequisites

  1. A Splunk server. This will run the Splunk indexer and Wazuh app for Splunk.

  2. A single node Wazuh manager server. This is where the Splunk forwarder will be run.

Before installing the Splunk indexer, some extra packages must be installed on the indexer node:

Install all the required utilities:

# yum install curl

Install all the required utilities:

# apt-get install curl apt-transport-https lsb-release gnupg

Warning

This section will install Splunk using the minimal Splunk deployment schema. If you want a more advanced installation, check out the multi-instance deployment schema.

Install and configure Splunk indexer

This component receives the data flow streamed by a forwarder and stores it in a Splunk index.

  1. Download the Splunk package from its official website. The versions of Splunk compatible with Wazuh and the Wazuh app for Splunk can be found here.

    Note

    • Splunk is not open source software, and it requires a registered user and license in order to work. You can also use a free trial license.

    • This guide will install and configure Splunk 8.2.6. If you intend to configure a different version of Splunk with Wazuh, change the Splunk version number in the requests for the configuration files and the Wazuh app for Splunk. For example, if you intend to configure Splunk 8.2.2:

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/indexes.conf
      

      Becomes

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.2/setup/indexer/indexes.conf
      
  2. Install the Splunk package:

    1. For RPM based distributions:

      # yum install splunk-enterprise-package.rpm
      
    2. For Debian/Ubuntu distributions:

      # dpkg --install splunk-enterprise-package.deb
      
  3. Configure inputs.conf and indexes.conf:

    1. Create indexes.conf:

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/indexes.conf
      
    2. Create ìnputs.conf:

      # curl -so /opt/splunk/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/inputs.conf
      
  4. Ensure Splunk is installed in /opt/splunk and start the service:

    # /opt/splunk/bin/splunk start
    

    Note

    This command will make a Splunk General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

  5. Open Splunk in your preferred browser.

  6. Navigate to Settings > Data > Forwarding and receiving.

  7. Select “Configure receiving”

  8. Add an unused port as a new receiving port and save it.

  9. Restart the Splunk service

    # /opt/splunk/bin/splunk restart
    
  10. Optional. If you additionally want the Splunk service to start at boot time, please execute the following command:

    # /opt/splunk/bin/splunk enable boot-start
    

Install and configure Splunk forwarder

A Splunk forwarder is required in order to send alerts to the Splunk indexer. Depending on the type of architecture that you’re installing, the Splunk forwarder is configured differently.

  1. Download the Splunk package from its official website. The versions of Splunk compatible with Wazuh and the Wazuh app for Splunk can be found here.

    Note

    • Splunk is not open source software, and it requires a registered user and license in order to work. You can also use a free trial license.

    • This guide will install and configure Splunk 8.2.6. If you intend to configure a different version of Splunk with Wazuh, change the Splunk version number in the requests for the configuration files and the Wazuh app for Splunk. For example, if you intend to configure Splunk 8.2.2:

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/indexer/indexes.conf
      

      Becomes

      # curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.2/setup/indexer/indexes.conf
      
  2. Install the Splunk forwarder package on the Wazuh manager:

    # yum install splunkforwarder-package.rpm
    
    # dpkg --install splunkforwarder-package.deb
    

Configuration

This section explains how to configure the Splunk forwarder to send alerts to the Splunk indexer component.

  • props.conf: In order to consume data inputs, Splunk needs to specify what kind of format it will handle. The props.conf file specifies the data format Splunk can handle.

  • inputs.conf: The Splunk forwarder needs this file to read data from an input. In this case, the Wazuh alerts file.

Creating the configuration files

  1. Download and insert the props.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/props.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/forwarder/props.conf
    
  2. Download and insert the inputs.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.8-8.2.6/setup/forwarder/inputs.conf
    
  3. Set the Wazuh manager hostname:

    # sed -i "s:MANAGER_HOSTNAME:$(hostname):g" /opt/splunkforwarder/etc/system/local/inputs.conf
    

Set up data forwarding

  1. Create the file outputs.conf:

    # touch /opt/splunkforwarder/etc/system/local/outputs.conf
    
  2. Fill it with the content below:

    [tcpout]
    defaultGroup = default-autolb-group
    
    [tcpout:default-autolb-group]
    server = <INDEXER_IP>:9997
    clientCert = /opt/splunkforwarder/etc/auth/server.pem
    sslRootCAPath = /opt/splunkforwarder/etc/auth/ca.pem
    sslPassword = password
    
    [tcpout-server://<INDEXER_IP>:9997]
    
    • INDEXER_IP is the IP address of the Splunk indexer.

  3. Start the Splunk forwarder service:

    # /opt/splunkforwarder/bin/splunk start
    

    Note

    This command will make a Splunk forwarder General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

    • Splunk username (created previously)

    • Password of Splunk username

    Warning

    If you get an error message about port 8089 already being in use, you can change it to use a different one.

    After installing the Splunk forwarder, incoming data should appear in the designated Indexer.

  4. Optional. If you want the Splunk forwarder service to start at boot time, please execute the following command:

    # /opt/splunkforwarder/bin/splunk enable boot-start
    
  1. Start the Splunk forwarder:

    # /opt/splunkforwarder/bin/splunk start
    

    Note

    This command will make a Splunk forwarder General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

    Warning

    If you get an error message about port 8089 already being in use, you will be prompted to change it to use a different one.

  2. Point the Splunk forwarder output to Wazuh Splunk indexer with the following command:

    # /opt/splunkforwarder/bin/splunk add forward-server <INDEXER_IP>:<INDEXER_PORT>
    
    • INDEXER_IP is the IP address of the Splunk Indexer.

    • INDEXER_PORT is the port of the Splunk indexer earlier configured in receiving.

    Note

    This command will make a Splunk forwarder General Terms appear that will have to be accepted, and then, will ask for a series of information such as:

    • Administrator name

    • Password

    • Splunk username (created previously)

    • Password of Splunk username

  3. Start the Splunk forwarder service:

    # /opt/splunkforwarder/bin/splunk start
    

    Warning

    If you get an error message about port 8089 already being in use, you can change it to use a different one.

    After installing the Splunk Forwarder, incoming data should appear in the designated Indexer.

  4. Optional. If you want the Splunk forwarder service to start at boot time, please execute the following command:

    # /opt/splunkforwarder/bin/splunk enable boot-start
    

Now that you’ve finished installing Splunk using the minimal Splunk distributed architecture, you can proceed with the next step and install the Wazuh app for Splunk.