Splunk Installation

[mailmetoramu]

Hi All,

Actually have intsalled splunk successfully in my VM linux machine. Then installed universal forwarder in my windows laptop.

While configuring it is showing two parameters as follow :

1) Configure Deployement IP - IP :8089 (Showing Optional)

After clicking next its showing the below :

2) Configure Indexer IP - IP :9997 (Showing Optional)

Now please let me know which IP i need to configure & also after configuring do i need execute any commands to establish a connection between my windows laptop machine & VM linux machine.

Thanks,

Ramu.R

[richgalloway · Accepted solution]

If you don't have a deployment server (which a single-server installation won't), choose the option to enter the indexer address (the Linux machine).

After you do that, sign in your Splunk server (Linux) and enable receiving by going to Settings->Forwarding and Receiving->Configure Receiving, click New, then enter the port number (9997 is typical).

Of course, you'll also need to check your firewalls settings to make sure communication between the two machines is allowed.

[mailmetoramu]

Can you please mention the commands needs to execute in linux machine for the steps you mentioned above.

Thanks,

Ramu.R

[skoelpin]

You can do it through the UI or by running this command

/opt/splunk/bin/splunk enable listen 9997 -auth <username>:<password>

[richgalloway]

There are no commands for the first part - just answer the questions asked by the installer.

There are no commands for the second part. Sign in to the Splunk UI and follow the directions in my answer.

The commands for the last part depend on your environment. Consult your Linux and Windows admins for assistance.