Do I need to Install splunk add on for linux in both forwarder machine and splunk server machine?

[kv]

I need to configure the Splunk Add-on for Linux in both forwarder and Splunk server machines.

I have Splunk Enterprise running on windows and collecting the logs from Linux using Splunk forwarder.

To get the dashboard from Splunk add on Linux, Do I need to install the add-on on both machines,

if so what steps do I need to follow on a Linux host machine?

Many thanks for considering my request.

[gcusello · Accepted solution]

Hi @kv,

yes you have to install the Splunk_TA_nix both on Forwarders (to input data) and on the Splunk Server (for parsing data).

I don't like that you use Windows for the Splunk Server because, in my experience (11 yeears), I didn't see any relevant proction installation on Windows, only labs and PoCs.

In addition, if you want to use the Splunk Server also as Deployment Server to send Apps to the Forwarders you'll have problems on file grants (especially scripts take wrong grants).

Anyway, as I said, you have to install the Add-On both on Forwarder and Splunk Server (that I suppose is an All-in-one server).

For the Splunk Server, you can install it by GUI and then configure it still by GUI telling to it which inputs must be enabled and which is the destination index for each one.

For the Forwarders, I usually hint to use the Splunk Server as Deployment Server, but you cannot because you're using a Windows Server, so you have to manually deploy it following these simple steps:

• copy the tgz file on the forwarder in the $SPLUNK_HOME/etc/apps folder,
• untar the file,
• enable the inputs you need (changing the option "disable 0 1" to "disabled = 0",
• delete the tgz file,
• restart Splunk on forwarder.

i suppose that you already configured the forwarder to send logs and the Splunk Server to receive them, otherwise you have to do this.

For more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Usingforwardingagents and https://docs.splunk.com/Documentation/Splunk/9.0.2/Forwarding/Aboutforwardingandreceivingdata

Ciao.

Giuseppe