Installation

Splunk forwarder in ubuntu

shadowit
Engager

i have installed Ubuntu & kali on virtualbox. i have installed DVWA application on ubuntu and now i have to install splunk forwarder in ubuntu and capture DVWA application logs when i aattack on dvwa application via kali Vm then Alerts + logs has to generated and sent to Host window 10 where i installed splunk means directly sent to splunk on window10. i wanted to know how to install splunk forwarder and how to configure input config file and output config file and how to add monitor command  and i have tried installing Splunk forwarder but facing difficulty.

Kindly connect and let me know 

 https://www.linkedin.com/in/shadoww-jin-b1b71a192/

 

Labels (1)
Tags (1)

inventsekar
Ultra Champion

@nwuest Great and Detailed Answer !.. 

@shadowit .. this may be a biiig task(for a newbie).. you will need to go thru step by step.. (it will be an easy task for a splunk admin actually).. 

As you are linux comfortable guy, its not a big and difficult task. please check the ubuntu Universal Forwarder installation, as listed above. on your progress, if you are struck, please let us know. thanks. 

0 Karma

nwuest
Path Finder

Hi @shadowit,

Kali VM: Your attack platform

Ubuntu VM: DVWA application
Splunk Universal Forwarder is installed on the Ubuntu machine

  1. "i wanted to know how to install splunk forwarder"
    Check out the following link: Install the universal forwarder on Linux

  2. ".. how to configure an output config file"
    Check out the following link: Configure forwarding with outputs.conf 
    ** This is to be configured on the Splunk Universal Forwarder

  3. Add-on App "Install the *nix app on the Ubuntu VM"
    Check out the following link: Splunk Add-on for Unix and Linux 
    This app will help monitor some applicable logs that will be useful to monitoring your activities with the Kali VM attacking the DVWA.
  4. "how to add monitor command"
    Check out the following link: Monitor files and directories with the CLI 
    This will help you monitor other log files not covered in the *nix app from point 3.

Windows 10: Splunk Enterprise instance set up as an Indexer
Splunk Enterprise installed as an Indexer/SearchHead

  1. Add-on question "How to install Splunk Enterprise"
    Check out the following link: Windows installation instructions 
    Follow these instructions to set up the Windows 10 machine as an Indexer
  2. "how to configure input config file"
    Check out the following link: Configure your inputs 
    ** This is to be configure on the Splunk Enterprise instance set up as an Indexer


We do hope this helps get you on your way @shadowit, do let us know your progress and if this has helped.

V/R,
nwuest

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...