@PickleRick  So I did some tweaking with your comments and landed on this. However... I am running into an issue with enabling boot-start or doing any of the ./splunk restart/stop/start commands. Before running it outputs: "Warning: Attempting to revert the SPLUNK_HOME ownership" and "Warning: Executing "chown -R root /opt/splunkforwarder" before the ./splunk restart command - and then the restart command hangs and never finishes. Can't really seem to figure out why this is happening or if its something i did that messed up the filesystem of the desktop I am working on. Let me know what you think 🙂   #!/bin/bash set -o errexit # User input. Comment out this section and replace with $serv and $depserv with hardcoded variables below if you choose to omit # You also may need to change the port #'s if you chose to not use the splunk default ports in your environment read -p "Please enter the name of Splunk server you will be forwarding your logs to: " serv if ping -c 1 "$serv" &> /dev/null then echo "Server Succesfully Reached" else echo "Server cannot be reached" exit fi while true; do read -p "Do you have a Splunk Deployment Server? (y/n) " dep if [[ $dep = "y" ]]; then read -p "Enter deployment server name: " depserv if ping -c 1 "$depserv" &> /dev/null then echo "Server Succesfully Reached" break else echo "Server cannot be reached" exit fi elif [[ $dep = "n" ]]; then echo "User does not have a deployment server" break else echo "Please enter 'y' for yes or 'n' for no: " fi done # This will check for/delete the installation of splunk forwarder if there already is one installed. allows you to run script again to reinstall FILE=/opt/splunkforwarder if [ -d "$FILE" ]; then while true; do read -p "A version of Splunk is already installed. Do you wish the overwrite? (y/n) " over if [[ $over = "y" ]]; then sudo /opt/splunkforwarder/bin/splunk stop sudo rm -rf /opt/splunkforwarder break elif [[ $over = "n" ]]; then echo -e "\nUser chose to not overwrite existing version of Splunk\n" exit else echo "Please enter 'y' for yes or 'n' for no: " fi done fi # Edit this section to get the most recent up to date wget command for downloading splunk forwarder # Splunk version 9.0 temp_dir=$(mktemp -d) cd $temp_dir wget -O splunkforwarder-9.0.0-6818ac46f2ec-Linux-x86_64.tgz "https://download.splunk.com/products/universalforwarder/releases/9.0.0/linux/splunkforwarder-9.0.0-6818ac46f2ec-Linux-x86_64.tgz" &> /dev/null if [[ "$?" != 0 ]]; then echo -e "Failed to download file. Exiting script.\n" rm -r $temp_dir exit else echo -e "\nSplunk files successfuly downloaded\n" fi tar xvzf splunkforwarder-9.0.0-6818ac46f2ec-Linux-x86_64.tgz -C /opt rm -r $temp_dir # Default username is admin # Generates random password for admin account. Random password can be found in script output if you wish to take note of it cd /opt/splunkforwarder/bin sudo ./splunk start --accept-license --no-prompt --gen-and-print-passwd #sudo ./splunk enable boot-start seems to not be working here. splunk must be stopped for it to be enabled #Adds the instance of where you are going to be forwarding your logs cd /opt/splunkforwarder/etc/system/local sudo touch outputs.conf echo -e "Outputs.conf \n" sudo tee -a outputs.conf << END [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = $serv:9997 [tcpout-server://$serv:9997] END # Adds the monitoring of var/log/syslog (relatively important for monitoring linux (ubuntu) servers) # This is optional. The inputs you choose to monitor should be configured from a deployment server # Comment out if you choose it is not needed sudo touch inputs.conf echo -e "Inputs.conf \n" echo "[monitor://var/log/syslog]" | sudo tee -a /opt/splunkforwarder/etc/system/local/inputs.conf echo "disabled = 0" | sudo tee -a /opt/splunkforwarder/etc/system/local/inputs.conf # Adds the deployment server for managing the newly created instance (optional but defnitely should use a deployment server) if [[ $dep = "y" ]]; then sudo touch deploymentclient.conf echo -e "\nDeploymentclient.conf \n" sudo tee -a deploymentclient.conf << END [deployment-client] [target-broker:deploymentServer] targetUri = $depserv:8089 END fi echo -e "\nEnd of file changes \n" #reboots splunk to save changes #sudo ./opt/splunkforwarder/bin/splunk stop #sudo /opt/splunkforwarder/bin/splunk enable boot-start #sudo ./opt/splunkforwarder/bin/splunk start cd /opt/splunkforwarder/bin sudo ./splunk restart     ... View more

This is great constructive feedback of several things I didn't know about. Thank you 🙌 ... View more

I said it was old. 😆If it works it works  1) Idk what you mean by crypto materials. bitcoin? It should probably have a sudo ./splunk stop command before deleting the directory but idk what else you would want 2) wget doesn't need sudo? idk  3) so essentially cd /opt && wget install splunk && then delete the install file ? 4) yeah ur right 5) i guess it would be better practice to do that. i was just copy and pasting from my notes to try and help 6) it could but i just wrote the variables in caps to be changed since the point of my script when i wrote it is to have Zero user interaction 7) again I want zero user interaction so randomly generating them into the void works for me since you can just manually edit and file in the future. imo they aren't needed or at least I haven't seen a case where i need admin credentials on a forwarder  ... View more

This is an old version of a script I use to install splunk forwarder on Linux (ubuntu) servers and connect up to a splunk enterprise instance and deployment server. In case this may be useful to anyone who comes across this thread in the future  #!/bin/bash set -o errexit # This will delete the installation of splunk forwarder if there already is one installed. allows you to run script to reinstall sudo rm -f /opt/splunkforwarder # Edit this section to get the most recent up to date wget command for downloading splunk forwarder sudo wget -O splunkforwarder-8.2.0-e053ef3c985f-Linux-x86_64.tgz 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.2.0&product=universalforwarder&filename=spl$ sudo tar xvzf splunkforwarder-8.2.0-e053ef3c985f-Linux-x86_64.tgz -C /opt cd /opt/splunkforwarder/bin # default username is admin # generates random password for admin account sudo ./splunk start --accept-license --no-prompt --gen-and-print-passwd #enables start on boot sudo ./splunk enable boot-start #Adds the instance of where you are going to be forwarding your logs cd /opt/splunkforwarder/etc/system/local sudo touch outputs.conf echo "" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "[tcpout]" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "defaultGroup = default-autolb-group" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "[tcpout:default-autolb-group" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "disabled = false" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "server = NAME_OF_YOUR_SPLUNK_SERVER:9997" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf echo "[tcpout-server://NAME_OF_YOUR_SPLUNK_SERVER:9997]" | sudo tee -a /opt/splunkforwarder/etc/system/local/outputs.conf #adds the monitoring of var/log/syslog (relatively important for monitoring linux (ubuntu) servers. optional however and can be configured from a deployment server) sudo touch inputs.conf echo "[monitor://var/log/syslog]" | sudo tee -a /opt/splunkforwarder/etc/system/local/inputs.conf echo "disabled = 0" | sudo tee -a /opt/splunkforwarder/etc/system/local/inputs.conf #adds the deployment server for managing the newly created instance (optional but defnitely should use a deployment server) sudo touch deploymentclient.conf echo "[deployment-client]" | sudo tee -a /opt/splunkforwarder/etc/system/local/deploymentclient.conf echo "[target-broker:deploymentServer]" | sudo tee -a /opt/splunkforwarder/etc/system/local/deploymentclient.conf echo "targetUri = NAME_OF_DEPLOYMENT_SERVER:8089" | sudo tee -a /opt/splunkforwarder/etc/system/local/deploymentclient.conf #reboots splunk to save changes cd /opt/splunkforwarder/bin sudo ./splunk restart    ... View more

Is Splunk Assist free to use?  ... View more

Do you have any recommendations of such a device? ... View more

Ah, then yes the Windows add on was originally deployed through my deployment server. No manually installation of apps was done - only on the deploy server when I originally set it up to go out. On my clients it does indeed have System with full control for all of the Universal Forwarder. ... View more

I think so, if installing the universal forwarder and pointing it towards the deployment server and main enterprise instance is what you mean. The files are owned by my account on the clients. Is there a way to have used my splunk deployment server to say go find these servers and install the universal forwarder?  Should I edit the permissions on the client's files to give permission to something else? Not sure how to link to to the deployment server as that is a server, and not a user account. Both are windows environment.  ... View more

Here is more or less the barebones of what I have. With the parent base search being what I already posted and my chain search on top of that trying to pull specific fields from that original data. Or if I am doing this wrong altogether in the wrong part of splunk enterprise ui let me know ... View more

Yup, found this preexisting alert and was able to edit the Actions on it to integrate with the Slack Notifications add-on. Runs every 5 minutes to check if the server is down so this works perfectly for me. Thanks for the help! ... View more

@plaks Can you be more specific as to what steps you followed to do this. Running into the same error on Splunk Enterprise. ... View more

You're correct, it does work. It took me a while to found the inputs that I enabled were receiving permission denied when trying to run on the forwarder through checking index=_internal. According to another post above -  .sh inputs won't necessarily work easily (which are like the top 4 that I enabled to test out at the top of the inputs.conf file). So it was "working" the whole time, just receiving errors for those specific inputs.  ... View more

Do you know how to give them execute permission? I now see that the few things I enabled in inputs.conf are .sh - and when checking index=_internal I can see that for each of them it says permission denied (Hence why nothing was showing up in the first place and I thought the add-on wouldn't work at all) Alternatively, if I can't use the .sh monitoring inputs, do you know what else is available from the add-on that would be useful? ... View more

@solarboyz1 So, in order to link the data coming in to the InfoSec app, I should add the appropriate tags to correlate to which requirement I want it to fulfill? After adding the tags, the macro should recognize the new data, right? I will do some looking into adding tags - never done that before. ... View more

So if its an overkill to do it with Splunk - then it definitely should work. Good to know that my methodology checks out.  ... View more