About splunk installation

arif751 — Tue, 02 Jul 2024 13:56:31 GMT

I am noob in SOC, currently started learning. I use Splunk for practice.. So recently, I installed Universal Forwarder in my VMWare Windows 10 OS and Splunk enterprise in my main desktop. During universal forwarder installation, I gave my main PC ip in the Deployment host & VM windows ip in Receiving host option (Port was default).

But after installing, my forwarder management is not showing any client in there in Splunk. I tried my main ip in both., changed my IP to static to dynamic, chose Bridged & NAT both network option in VM. Nothing is working.

Splunk is not connecting to client. Need urgent help to start practicing!! Hoping the actual solution.

Thanks in advance.

Re: About splunk installation

richgalloway — Tue, 02 Jul 2024 14:03:11 GMT

Since you do not have a Deployment Server (they're optional), leave the "Deployment host" box empty when installing the UF. Put your Splunk Enterprise IP address in the "Receiving host" box. In Splunk Enterprise, enable data reception by going to Settings->Forwarding and Receiving and clicking on "Configure receiving".

topic Re: About splunk installation in Deployment Architecture

About splunk installation

Re: About splunk installation