3.3.1 splunk server

splunk历史版本下载地址，需要用户注册，注册具体过程不演示。

#选择版本
https://www.splunk.com/page/previous_releases
#使用RPM的版本8.1.3
https://download.splunk.com/products/splunk/releases/8.1.3/linux/splunk-8.1.3-63079c59e632-linux-2.6-x86_64.rpm
#使用DEB的版本8.1.3
https://download.splunk.com/products/splunk/releases/8.1.3/linux/splunk-8.1.3-63079c59e632-linux-2.6-amd64.deb

下载到splunk（192.168.1.103）这台服务器上面。使用rpm命令就可以安装。

[root@splunk ~]# rpm -ivh splunk-8.1.3-63079c59e632-linux-2.6-x86_64.rpm 
warning: splunk-8.1.3-63079c59e632-linux-2.6-x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID b3cd4420: NOKEY
Preparing...                          ################################# [100%]
Updating / installing...
   1:splunk-8.1.3-63079c59e632        ################################# [100%]
cp: cannot stat ‘/opt/splunk/etc/regid.2001-12.com.splunk-Splunk-Enterprise.swidtag’: No such file or directory
complete

发现安装有错误，只需复制文件就可以。

[root@splunk ~]# cp /opt/splunk/swidtag/splunk-Splunk-Enterprise-primary.swidtag /usr/share/regid.2001-12.com.splunk
[root@splunk ~]# chown splunk:splunk /usr/share/regid.2001-12.com.splunk/splunk-Splunk-Enterprise-primary.swidtag

创建索引文件：/opt/splunk/etc/system/local/indexes.conf，往文件增加网址里面的内容。

[wazuh]
coldPath = $SPLUNK_DB/wazuh/colddb
enableDataIntegrityControl = 1
enableTsidxReduction = 1
homePath = $SPLUNK_DB/wazuh/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/wazuh/thaweddb
timePeriodInSecBeforeTsidxReduction = 15552000
tsidxReductionCheckPeriodInSec =

[wazuh-monitoring]
coldPath = $SPLUNK_DB/wazuh-monitoring/colddb
enableDataIntegrityControl = 1
enableTsidxReduction = 1
homePath = $SPLUNK_DB/wazuh-monitoring/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/wazuh-monitoring/thaweddb
timePeriodInSecBeforeTsidxReduction = 15552000
tsidxReductionCheckPeriodInSec =

创建日志输入配置文件：/opt/splunk/etc/system/local/inputs.conf。

[splunktcp://9997]
connection_host = ip

启动splunk并且初始化，输入y同意安装协议之后，就可以输入用户和密码就能够自动安装。

[root@splunk ~]# /opt/splunk/bin/splunk start

启动之后，可以看到9997端口已经是监听状态。

设置splunk服务为开机启动

[root@splunk ~]# /opt/splunk/bin/splunk enable boot-start
Init script installed at /etc/init.d/splunk.
Init script is configured to run at boot.

在浏览器打开http://192.168.1.103:8000，按照预先设置好的账号和密码进行登录。