Forwarder Installation Script

GKC_DavidAnso — Mon, 22 Jun 2020 19:10:15 GMT

I have created the script below to deploy forwarders to Linux servers. Hopefully it is of use to others in the community.

If you execute the script it will tell you which parameters it expects to receive.

The script expects to deploy a .tgz but could easily be tweaked to install an RPM, DEB or similar package. However in those situations I would generally look to utilise whatever package management system is available (e.g. a Satellite server for RedHat) to make patching easier.

I hope you find this helpful.

#!/bin/bash

################################################
################################################
### Splunk> Forwarder Mass Deployment Script ###
### Author:   David Anso - GKC Limited       ###
### Version:  1.0                            ###
################################################
################################################
### www.gkc.co.nz

REMOTE_HOST=$1
REMOTE_USER=$2
REMOTE_PATH="$3"
ENABLE_KEYBASED_AUTH=$4
ENABLE_BOOT_START=$5

SPLUNKFORWARDERTGZ="splunkforwarder-4.3-115073-Linux-x86_64.tgz"
INSTALLER_HOME="/home/splunker/install-forwarder/"
SPLUNKDEPLOYCLIENTCONF="deploymentclient.conf"
SSH_PUBLIC_KEY="/home/splunker/.ssh/id_rsa.pub"

cd $INSTALLER_HOME

if [ -z $5 ]
then
    echo "Usage: $0 Host User Path Enable_SSHKeys EnableBootStart"
    echo " e.g.: $0 splunkforwarder1 splunkuser /opt 1 1"
    exit 1
fi

if [ $ENABLE_KEYBASED_AUTH -gt 0 ]
then
    cat $SSH_PUBLIC_KEY | ssh $REMOTE_HOST -l $REMOTE_USER "if [ ! -e .ssh ] ; then mkdir ~/.ssh; fi ; cat \ >>~/.ssh/authorized_keys ; chmod 600 ~/.ssh/authorized_keys ;chmod 700 ~/.ssh"
    ssh $REMOTE_HOST -l $REMOTE_USER echo If you only typed the password once then key based auth is working.
fi

echo "Copying files..."
scp $SPLUNKFORWARDERTGZ $SPLUNKDEPLOYCLIENTCONF $REMOTE_USER@$REMOTE_HOST:$REMOTE_PATH
ssh $REMOTE_HOST "
    cd $REMOTE_PATH; 
    tar -xzf $REMOTE_PATH/$SPLUNKFORWARDERTGZ ;  
        rm $REMOTE_PATH/$SPLUNKFORWARDERTGZ ;
        mv $REMOTE_PATH/$SPLUNKDEPLOYCLIENTCONF $REMOTE_PATH/splunkforwarder/etc/system/local/deploymentclient.conf;
        splunkforwarder/bin/splunk start --accept-license
"

echo ""

if [ $ENABLE_BOOT_START -gt 0 ]
then
    echo "Enabling Boot Start..."
    ssh $REMOTE_HOST -t -l $REMOTE_USER "sudo $REMOTE_PATH/splunkforwarder/bin/splunk enable boot-start"
fi

Re: Forwarder Installation Script

rturk — Thu, 29 Aug 2013 00:38:43 GMT

That's excellent David... I particularly like the 'exam' tag 😉

(You might want to mark your own "question" as answered though)

Re: Forwarder Installation Script

GKC_DavidAnso — Thu, 29 Aug 2013 01:37:01 GMT

Feel free to leave comments if you have any questions.

Re: Forwarder Installation Script

gvhees — Thu, 29 Aug 2013 20:28:56 GMT

Hi David,

Works like a charm. Thanks for sharing it. I came in most helpful when I needed.

Cheers,
Ger

Re: Forwarder Installation Script

ashabc — Sun, 13 Dec 2015 00:58:31 GMT

If you want more detailed explanation and options, Splunk official document for scripted install example is here:

For *NIX
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Remotelydeployanixdfwithastaticconfiguration

For Windows:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Deployawindowsdfviathecommandline

You may need to use psexec command from another windows host, if you do not have RDP/console access to the target windows client.

topic Re: Forwarder Installation Script in Installation

Forwarder Installation Script

Re: Forwarder Installation Script

Re: Forwarder Installation Script

Re: Forwarder Installation Script

Re: Forwarder Installation Script