01_PS_Splunk 9_Installation and Configuration

 Table of Contents

1 Course Overview 1

1.1 Course Overview 1

2 What Is Splunk? 1

2.1 Overview 1

2.2 What Is Machine Data? 3

2.3 Past, Present, and Future of Splunk 5

2.4 Splunk Architecture and Licenses 6

2.5 Splunk Documentation and Community Tour 7

2.6 Summary 8

3 Installing Splunk Enterprise 8

3.1 Overview 8

3.2 Building Splunk Environments 9

3.3 Setting Up Splunk 9

3.4 Demo: Installing in Windows Environment 10

3.5 Demo: Installing in Linux Environment 10

3.6 Splunk in the Cloud 12

3.7 Demo: Splunk Cloud Options 13

3.8 Summary 14

4 Navigating and Configuring the Splunk Enterprise 15

4.1 Overview 15

4.2 Getting Data into Splunk 15

4.3 Demo: Getting Data into Splunk – web log file 15

4.4 Navigating Splunk Search 16

4.4.1 How to Search in Splunk 16

4.4.2 Basic Splunk Search 17

4.5 Demo: Adding More Data into Splunk 17

4.6 Demo: Installing Splunk Apps 17

4.7 Splunk Roles in Search 18

4.8 Demo: Splunk User Roles 18

4.9 Summary 21

5 Wrapping up Splunk Enterprise Installation and Configuration 21

5.1 Splunk Learning Path 21

1. Course Overview

1. Course Overview

• Splunk for Analysing and Processing data and Data Anaytics

• Different Roles

• Different Environemnt – Linux, Mac, Windows

2. What Is Splunk?

1. Overview

What is Machine Data?

2. What Is Machine Data?

IIS Log, Windows Event Log

https://www.idc.com/

3. Past, Present, and Future of Splunk

Splunkbase

4. Splunk Architecture and Licenses

• 3 Architectural Building Blocks

• Index  (3 types of indexes) 

• Search Head 

• Forwarder

5. Splunk Documentation and Community Tour

WWW.SPLUNK.COM / sigin in Resources >  Platform > Splunk Enterprises – we can choose the Product / Version to get the appropriate help

• User Groups – splunk community > Signin

• Community 

• Splunkbase

• https://splunkbase.splunk.com/app/6143 -- find more information

• 
  
• 
  

6. Summary

3. Installing Splunk Enterprise

1. Overview

2. Building Splunk Environments

3. Setting Up Splunk

• Get Free Licensing 

• Register 

• Request

• Download

• Cloud Trial

• Search Heaed > Indexes > Environments 

• 

• In this course all going into one location (Indexer / Search Head / Forwarder)

• Data ingest Limitations based on the licenses – for free 500 MB / day

• Ports

• 8000 default to login with Username and password http://localhost:8000/

• 8090 – Management Port

• 
  

4. Demo: Installing in Windows Environment

• Login Splunk  - go to Dashboard -  Free trials and downloads – documentation link available to check prerequisites – Download and install

5. Demo: Installing in Linux Environment

• Login to Dashboard – Free Trials and Downloads – Choose Splunk Enterprise – Choose Linux – Check System Requirements in documentation Link -  Choose .rpm  - Download Now – Click Download via Command Line (wget)

• 

• 

• Copy the content – Login to Linux Server – 

• Sudo yum install wget --- check we can use wget

• Sestatus  --- check linux status

• 

• Enforcing to Permissive – 

• Sudo setenforce 0

•  

• Paste the wget code – it will download the splunk

• If not loading check the firewall

6. Splunk in the Cloud

7. Demo: Splunk Cloud Options

• No need to download 

• Login to Dashboard – Free Trials and Downloads –  Choose Splunk Cloud – directly goest to our URL – takes 10 minutes to configure and set up – this is valid only 15 days

• If we are AWS customer, we can login EC2 Dashboard – AMI Catelog search splunk – we can get splunk enterprise – download and install

8. Summary

4. Navigating and Configuring the Splunk Enterprise

1. Overview

2. Getting Data into Splunk

3. Demo: Getting Data into Splunk – web log file

• Log in Splunk – Settinbgs – Data section – Data Input or 

• Quick Link > Add Data

• http://127.0.0.1:8000/en-US/manager/search/adddata

• When we add data, it ask to create Index for that data

4. Navigating Splunk Search 

1. How to Search in Splunk

• Basic Search

• SPL – Splunk Processing Language

• Splunkbase

• APIs

2. Basic Splunk Search

5. Demo: Adding More Data into Splunk

• Add Data – Monitoring – Local Event Logs - Select all fiedls 

6. Demo: Installing Splunk Apps

• Splunkbase – search  Dell PowerScale App for Splunk

• OR In splunk Dashboard – Find more Apps link – this will connect splunkbase with all api or applications – we can install by using splunk account

• 
  
• 
  

7. Splunk Roles in Search

8. Demo: Splunk User Roles

• Settings – USERS AND AUTHENTICATIONS – Roles

• We can create new roles also

• Documentation - https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/Rolesandcapabilities

• Edit_helth capability is with Admin role – can  do the health check of splunk

• How to create user

• 

• 
  

9. Summary

5. Wrapping up Splunk Enterprise Installation and Configuration

1. Splunk Learning Path