All Apps and Add-ons

Installing Forwarder on Centos machine remotly

khalidewaidah
Explorer

Dear ,
Do you have tested script in-order to install splunk forwarder last version remotely .

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi khalidewaidah,
I didn't installed just the last version, but some previous versions (7.2.0) and it was possible.
It was also a part of the old exam as Splunk Architect!

I used a shall script like this:

#!/bin/sh
# Script to remotely install Splunk forwarder

# to avoid to store readable password
read -s -p "Enter Splunk Admin Password: " PASSWORD
echo 

# Configuration file
source /home/archStudent/config.ini

# Command lists to execute in remote forwarder server
REMOTESCRIPT="
cd $DIRDEST
$WGETCMD
sudo tar -xzf $FWDTGZ
sudo chown -R archStudent:splunk $DIRDEST/splunkforwarder
sudo -H -u archStudent $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD
sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user archStudent
sudo chown -R archStudent:splunk $DIRDEST/splunkforwarder
sudo -H -u archStudent $DIRDEST/splunkforwarder/bin/splunk restart
"

# Installation execution
echo "===================== FORWARDER REMOTE INSTALLER ============================="
echo
sleep 5
echo "Reading host logins from $TARGETSFILE"
echo 
echo "Start Forwarder remote installation to:"

# hosts cycle
for DEST in `cat "$TARGETSFILE"`; do

    if [ -z "$DEST" ]; then
        continue;
    fi
    echo 
    echo "- $DEST"
    ssh "$DEST" "$REMOTESCRIPT"

done

and a config.ini file like this:

TARGETSFILE="/home/archStudent/targets.ini"
DIRDEST="/opt"
WGETCMD="sudo wget -O splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.0.2&product=universalforwarder&filename=splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz&wget=true'"
FWDTGZ="/opt/splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz"
DEPLOYSERVER="CUSELLO-SEARCH:8089"

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...