topic Re: bash script , automating splunkforwarder installation. in Splunk Enterprise

Has anyone written a bash script to install splunkforwarder on a linux server?

sphiwee — Tue, 21 Jun 2022 15:44:02 GMT

has anyone written a bash script to install splunkforwarder on a linux server? or is it impossible due to having to enter admin and password and also having to use different users while installing ?

Re: bash script , automating splunkforwarder installation.

isoutamo — Wed, 26 Aug 2020 18:10:00 GMT

there is example on Splunk’s docs https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/Installanixuniversalforwarderremotelywithastaticconfiguration

I think that you could found several ansible playbooks for doing this which could be more manageable? Personally I prefer ansible over shell scrips for this kind of stuff.

r. Ismo

Re: bash script , automating splunkforwarder installation.

richgalloway — Wed, 26 Aug 2020 18:33:40 GMT

See https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/Installanixuniversalforwarderremotelywithastaticconfiguration

Re: bash script , automating splunkforwarder installation.

thambisetty — Wed, 26 Aug 2020 18:50:56 GMT

It’s not impossible as you don’t require to set admin password while installing. You can automate this one completely.

I will share script soon.

Re: bash script , automating splunkforwarder installation.

sphiwee — Thu, 27 Aug 2020 08:00:25 GMT

Thank you, cant wait to see it

Re: bash script , automating splunkforwarder installation.

isoutamo — Thu, 27 Aug 2020 08:14:09 GMT

With sensible you could also set admin passwords when you installing it.

Here is Splunk's own ansible which they are actively updated.

https://github.com/splunk/splunk-ansible/tree/master

And some other playbooks:

r. Ismo

Re: bash script , automating splunkforwarder installation.

thambisetty — Thu, 27 Aug 2020 14:50:17 GMT

This is applicable for version 7.2.2 later.

you should run below commands with sudo user

useradd splunk tar splunkbinary.gz -C /opt chown -R splunk:splunk /opt/splunkforwarder /opt/splunkforwarderk/bin/splunk enable boot-start -systemd-managed 0 -user splunk --no-prompt --accept-license sudo -u splunk /opt/splunkforwarderk/bin/splunk start

Re: bash script , automating splunkforwarder installation.

sphiwee — Sun, 30 Aug 2020 16:59:25 GMT

and when do i add admin and password?

Re: bash script , automating splunkforwarder installation.

thambisetty — Sun, 30 Aug 2020 17:54:47 GMT

Hope you will manage deployment clients(where uf is installed) with deployment server. If yes, you don’t require to set the password at all.

Re: bash script , automating splunkforwarder installation.

sphiwee — Mon, 31 Aug 2020 12:21:36 GMT

okay, so when I add a log to monitor it wont require a password

Re: bash script , automating splunkforwarder installation.

thambisetty — Mon, 31 Aug 2020 12:43:43 GMT

that's why I have asked you, I hope you manage this client from Deployment server.

It will prompt for password if you add from CLI using splunk command.

you can update inputs.conf to avoid prompting for password.

Re: bash script , automating splunkforwarder installation.

sphiwee — Mon, 31 Aug 2020 13:09:37 GMT

Yes I'm using CLI

Re: bash script , automating splunkforwarder installation.

masonmorales — Mon, 08 Mar 2021 18:22:05 GMT

Re: bash script , automating splunkforwarder installation.

nikhilmfwd — Fri, 17 Jun 2022 07:25:33 GMT

hi team,

Can you please provide shell script to install forwarder into server. Basically i have a task to automate same.

Re: bash script , automating splunkforwarder installation.

richgalloway — Fri, 17 Jun 2022 19:13:01 GMT

Since this thread is 2 years old with an accepted solution, you should post a new question.

That said, have you tried this one? https://community.splunk.com/t5/Getting-Data-In/Simple-installation-script-for-Universal-Forwarder/m-p/21517

Re: bash script , automating splunkforwarder installation.

pc1 — Mon, 20 Jun 2022 18:45:40 GMT

This is an old version of a script I use to install splunk forwarder on Linux (ubuntu) servers and connect up to a splunk enterprise instance and deployment server. In case this may be useful to anyone who comes across this thread in the future

#!/bin/bash set -o errexit # This will delete the installation of splunk forwarder if there already is one installed. allows you to run script to reinstall sudo rm -f /opt/splunkforwarder # Edit this section to get the most recent up to date wget command for downloading splunk forwarder sudo wget -O splunkforwarder-8.2.0-e053ef3c985f-Linux-x86_64.tgz 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.2.0&product=universalforwarder&filename=spl$ sudo tar xvzf splunkforwarder-8.2.0-e053ef3c985f-Linux-x86_64.tgz -C /opt cd /opt/splunkforwarder/bin # default username is admin # generates random password for admin account sudo ./splunk start --accept-license --no-prompt --gen-and-print-passwd #enables start on boot sudo ./splunk enable boot-start #Adds the instance of where you are going to be forwarding your logs cd /opt/splunkforwarder/etc/system/local sudo touch outputs.conf echo "" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "[tcpout]" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "defaultGroup = default-autolb-group" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "[tcpout:default-autolb-group" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "disabled = false" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "server = NAME_OF_YOUR_SPLUNK_SERVER:9997" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "[tcpout-server://NAME_OF_YOUR_SPLUNK_SERVER:9997]" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf #adds the monitoring of var/log/syslog (relatively important for monitoring linux (ubuntu) servers. optional however and can be configured from a deployment server) sudo touch inputs.conf echo "[monitor://var/log/syslog]" | sudo tee -a /opt/splunkforwarder/etc/system/local/inputs.conf echo "disabled = 0" | sudo tee -a /opt/splunkforwarder/etc/system/local/inputs.conf #adds the deployment server for managing the newly created instance (optional but defnitely should use a deployment server) sudo touch deploymentclient.conf echo "[deployment-client]" | sudo tee -a /opt/splunkforwarder/etc/system/local/deploymentclient.conf echo "[target-broker:deploymentServer]" | sudo tee -a /opt/splunkforwarder/etc/system/local/deploymentclient.conf echo "targetUri = NAME_OF_DEPLOYMENT_SERVER:8089" | sudo tee -a /opt/splunkforwarder/etc/system/local/deploymentclient.conf #reboots splunk to save changes cd /opt/splunkforwarder/bin sudo ./splunk restart

Re: bash script , automating splunkforwarder installation.

PickleRick — Mon, 20 Jun 2022 19:31:48 GMT

Let me point out some flaws with your script.

1) Unconditional removal of /opt/splunkforwarder can be a bit hasty. Especially if you're using TLS and have crypto material stores somewhere in $SPLUNK_HOME

2) You're doing way too many things with sudo. Sudo should be used only if it's absolutely necessary. wget with elevated privileges? What for?

3) You're wgetting the installation archive into current directory. It'd be more elegant to create a temporary directory.

4) Instead of multiple echos you can simply do one cat with here-document.

5) You're leaving the installation archive behind.

6) The script could be parametrised.

7) You're happily ignoring randomly generated admin credentials. You might need them later.

😎 You can use splunk commands to modify configuration instead of creating the files by hand.

Re: bash script , automating splunkforwarder installation.

pc1 — Mon, 20 Jun 2022 19:46:43 GMT

I said it was old. 😆If it works it works

1) Idk what you mean by crypto materials. bitcoin?
It should probably have a sudo ./splunk stop command before deleting the directory but idk what else you would want

2) wget doesn't need sudo? idk

3) so essentially cd /opt && wget install splunk && then delete the install file ?

4) yeah ur right

5) i guess it would be better practice to do that. i was just copy and pasting from my notes to try and help

6) it could but i just wrote the variables in caps to be changed since the point of my script when i wrote it is to have Zero user interaction

7) again I want zero user interaction so randomly generating them into the void works for me since you can just manually edit and file in the future. imo they aren't needed or at least I haven't seen a case where i need admin credentials on a forwarder

Re: bash script , automating splunkforwarder installation.

PickleRick — Mon, 20 Jun 2022 19:58:16 GMT

First things first - it's not to say that the script does 't work or anything like that. It's just that I'm already old and grumpy 😉 and like well-written stuff so I point out what can be done better.

1) No. I mean private keys/certs for TLS. If it was my script and it was meant to be universal I'd do a conditional check for existence of old forwarder and a command-line switch to force removal in case of pre-existing dir.

2) Sure it doesn't it simply connects to a server and pulls a file from there. Where are elevated privileges needed here? Nowhere. You just need to be able to write a file in the destination directory.

3) The "pretty" solution would be to use mktemp to create a temporary directory (probably somewhere in /tmp) and delete it at the end of the script. Bonus points for capturing error states and removing the package on abnormal exit (but to be quite honest I'm usually too lazy to implement it myself).

7) btool might need them (especially if you want to run it without direct sudo/su to the user running the forwarder. Also listing inputs and monitor states. Sometimes these credentials are nice to have.

Re: bash script , automating splunkforwarder installation.

pc1 — Mon, 20 Jun 2022 20:42:53 GMT

This is great constructive feedback of several things I didn't know about. Thank you 🙌