Installation

Splunk forwarder in ubuntu

shadowit
Engager

i have installed Ubuntu & kali on virtualbox. i have installed DVWA application on ubuntu and now i have to install splunk forwarder in ubuntu and capture DVWA application logs when i aattack on dvwa application via kali Vm then Alerts + logs has to generated and sent to Host window 10 where i installed splunk means directly sent to splunk on window10. i wanted to know how to install splunk forwarder and how to configure input config file and output config file and how to add monitor command  and i have tried installing Splunk forwarder but facing difficulty.

Kindly connect and let me know 

 https://www.linkedin.com/in/shadoww-jin-b1b71a192/

 

Labels (1)
Tags (1)

inventsekar
Ultra Champion

@nwuest Great and Detailed Answer !.. 

@shadowit .. this may be a biiig task(for a newbie).. you will need to go thru step by step.. (it will be an easy task for a splunk admin actually).. 

As you are linux comfortable guy, its not a big and difficult task. please check the ubuntu Universal Forwarder installation, as listed above. on your progress, if you are struck, please let us know. thanks. 

0 Karma

nwuest
Path Finder

Hi @shadowit,

Kali VM: Your attack platform

Ubuntu VM: DVWA application
Splunk Universal Forwarder is installed on the Ubuntu machine

  1. "i wanted to know how to install splunk forwarder"
    Check out the following link: Install the universal forwarder on Linux

  2. ".. how to configure an output config file"
    Check out the following link: Configure forwarding with outputs.conf 
    ** This is to be configured on the Splunk Universal Forwarder

  3. Add-on App "Install the *nix app on the Ubuntu VM"
    Check out the following link: Splunk Add-on for Unix and Linux 
    This app will help monitor some applicable logs that will be useful to monitoring your activities with the Kali VM attacking the DVWA.
  4. "how to add monitor command"
    Check out the following link: Monitor files and directories with the CLI 
    This will help you monitor other log files not covered in the *nix app from point 3.

Windows 10: Splunk Enterprise instance set up as an Indexer
Splunk Enterprise installed as an Indexer/SearchHead

  1. Add-on question "How to install Splunk Enterprise"
    Check out the following link: Windows installation instructions 
    Follow these instructions to set up the Windows 10 machine as an Indexer
  2. "how to configure input config file"
    Check out the following link: Configure your inputs 
    ** This is to be configure on the Splunk Enterprise instance set up as an Indexer


We do hope this helps get you on your way @shadowit, do let us know your progress and if this has helped.

V/R,
nwuest

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...