How To Install & Manage Splunk Universal Forwarder in AWS Ec2
Tags: splunk, cloud, aws, devops
Published: 2023-04-03 20:22:47

## What is Splunk?
**Splunk is an application that is designed to search and analyze data gathered from the machine, devices, and well anything that sends data in your infrastructure.** 

## Splunk Cloud vs Splunk Enterprise ?
**The big difference here is that Splunk Enterprise is hosted on your company's infrastructure, or your personal machine if you are using it on your machine. Splunk Cloud is the same software however it is hosted in Splunk's Cloud and all this hardware is maintained by Splunk. Splunk Cloud reduces the time it takes to get to production as well as decreases the cost of your SIEM.**

## Universal Forwarder ?
**Universal Forwarders allow your machine to stream data to the receiver which is an index in Splunk Cloud. These forwarders allow use to monitor traffic in real time.**


## Splunk Installation Lab

**Create two instance on AWS ec2 as shown below**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sggudccu2lp1v781c1pr.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x846o5iroj0tad485a3q.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5lx4xuumn9ikmb6wiy4i.png)

**Install Splunk in both of them . In order to do that go to  Splunk Enterprise website and download the splunk for linux.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rp6unyh7jgox2r5jlfwf.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2hw8og7tcsl8xc19vn7j.png)

**Now install the splunk using command**

```
sudo yum install ./splunk <Splunk file name>
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x0tbipj9662qztqg6a2e.png)

**Move to bin folder** 

```
cd /opt/splunk/bin
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s4h922u61cec9i6prh3m.png)

**Create a license and start the splunk**

```
./splunk start --accept-license --answer-yes
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l0secwmgfe71d0rjxsxf.png)

**Add port 8000 in the security group**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xvxmdo1yljmuu22cjcpj.png)

**Now your splunk is read to run**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a4x4zcdfp31orraw5xgu.png)

**Put publicip:8000 in browser and login** 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n1lzwc084lm2eimowgy3.png)

**NOTE**

**Follow this above steps to install the splunk in both the server....**

**Now Clearly you can see there is no host present...**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/twirkul1x5q8sh6gdyee.png)

**so inorder to connect host we need universal forwarder...**

## Universal Forwarder Installation

**Go to splunk platform --> products --> Free trails and downloads**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5dcdruattvsauz6pzf43.png)

**Download the universal forwarder**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5k81njib4wxdvehobv18.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g21lqrcilo58r23c15d6.png)

**Install that forwarder using command :**

```
sudo yum install ./<splunk forwarder name>
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t27q1gl8rnixa10xu7fk.png)

**Now change path to bin folder and start the splunk** 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zr2wiqwylwgoyg960o50.png)

**It will ask for a port number , put any port [ Here I put 9089 ]**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qi0k0uao5nyj4vswoz9p.png)

**Now add the forward server to the splunk, Here I have put the public ip of splunk server**

```
./splunk add forward-server <publicip-splunk server>:9997
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k0rvs72j2ayftdfdrby6.png)

**Restart the splunk**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b4wqyd4lkq5daf7rxrnm.png)

**Now Put the log path :**

```
./splunk add monitor /var/log
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zlmdup190n1kkp4tm7ve.png)

**Restart the splunk again**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0vtof5llz92o6xbdjvrf.png)

**Now go to bin path and enable 9997 port listen**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gnbbqzgz40hmjl2s14yu.png)

**Restart the Splunk and you can see that the client is added to the forwarder.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zqy5n8507hcipmg10gap.png)

**Inorder to add the another server client .. Follow the same process above** 
**But in place of port input , Put a different port as shown below
9088**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/srmseqkq3gxvw76q29iy.png)

**Add forward server ip as splunk server public ip** 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0o64lwki7u7xmvh2o49c.png)

**After that you can see two ip in the host ...**
**One host is splunk server and another was universal forwarder**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/emz81oy16ehxzl7lyuu2.png)

**Click on the host name and you can see the logs file here**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o4evgabyjdzlq0i0flzm.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2r737yg0fme62vgyyw1m.png)

**Now create a test folder inside /opt/splunk/etc/deployment-apps ,
it will reflect in forwarder management apps**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9tqo8cx5wl01j21uj9gb.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p7uh6348vomvqn3k60bt.png)

**Now try to deploy a client using below commnads and restart the splunk**

```
./splunk set deploy-poll <splunk server ip>:8089
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/42uuwd19sloch1lwysqh.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o950r4j2o1sz3bdb4g9l.png)

**You can see the client here**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u848ich11jzckzp4wrk7.png)

**You can also create a server class and deploy that test app here**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cfkbld0xq6r4mhv3gnqg.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bp6kajohx1u4li2pn4h2.png)

**Add a client ip or hostname where you want to deploy**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4zrfqkub3r8e75ysqhex.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tyupafzgn2olqb9372f0.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ktzq5z2fvnc7l1luknq4.png)