# 3.3.1 splunk server

splunk历史版本下载地址，**需要用户注册**，注册具体过程不演示。

```
#选择版本
https://www.splunk.com/page/previous_releases
#使用RPM的版本8.1.3
https://download.splunk.com/products/splunk/releases/8.1.3/linux/splunk-8.1.3-63079c59e632-linux-2.6-x86_64.rpm
#使用DEB的版本8.1.3
https://download.splunk.com/products/splunk/releases/8.1.3/linux/splunk-8.1.3-63079c59e632-linux-2.6-amd64.deb
```

下载到splunk（192.168.1.103）这台服务器上面。使用rpm命令就可以安装。

```
[root@splunk ~]# rpm -ivh splunk-8.1.3-63079c59e632-linux-2.6-x86_64.rpm 
warning: splunk-8.1.3-63079c59e632-linux-2.6-x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID b3cd4420: NOKEY
Preparing...                          ################################# [100%]
Updating / installing...
   1:splunk-8.1.3-63079c59e632        ################################# [100%]
cp: cannot stat ‘/opt/splunk/etc/regid.2001-12.com.splunk-Splunk-Enterprise.swidtag’: No such file or directory
complete
```

发现安装有错误，只需复制文件就可以。

```
[root@splunk ~]# cp /opt/splunk/swidtag/splunk-Splunk-Enterprise-primary.swidtag /usr/share/regid.2001-12.com.splunk
[root@splunk ~]# chown splunk:splunk /usr/share/regid.2001-12.com.splunk/splunk-Splunk-Enterprise-primary.swidtag
```

创建索引文件：`/opt/splunk/etc/system/local/indexes.conf`，往文件增加网址里面的内容。

```
[wazuh]
coldPath = $SPLUNK_DB/wazuh/colddb
enableDataIntegrityControl = 1
enableTsidxReduction = 1
homePath = $SPLUNK_DB/wazuh/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/wazuh/thaweddb
timePeriodInSecBeforeTsidxReduction = 15552000
tsidxReductionCheckPeriodInSec =

[wazuh-monitoring]
coldPath = $SPLUNK_DB/wazuh-monitoring/colddb
enableDataIntegrityControl = 1
enableTsidxReduction = 1
homePath = $SPLUNK_DB/wazuh-monitoring/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/wazuh-monitoring/thaweddb
timePeriodInSecBeforeTsidxReduction = 15552000
tsidxReductionCheckPeriodInSec =
```

创建日志输入配置文件：`/opt/splunk/etc/system/local/inputs.conf`。

```
[splunktcp://9997]
connection_host = ip
```

启动splunk并且初始化，输入y同意安装协议之后，就可以输入用户和密码就能够自动安装。

```
[root@splunk ~]# /opt/splunk/bin/splunk start
```

启动之后，可以看到9997端口已经是监听状态。

![](https://2658646806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M_7EhqBo_t9a-xYYzeH%2F-MdN3v3nW5mHhcImRNcL%2F-MdN4kV3ZbRrRIf83abk%2Fimage.png?alt=media\&token=f4bd3ea6-c81b-4790-861d-7d485e55243e)

设置splunk服务为开机启动

```
[root@splunk ~]# /opt/splunk/bin/splunk enable boot-start
Init script installed at /etc/init.d/splunk.
Init script is configured to run at boot.
```

在浏览器打开http://192.168.1.103:8000，按照预先设置好的账号和密码进行登录。

![](https://2658646806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M_7EhqBo_t9a-xYYzeH%2F-MdMvhfNBNi-waCVwk4Y%2F-MdMw1P6Tn5P12j2RcYY%2Fimage.png?alt=media\&token=8aa45723-a983-4f5c-b6d0-7985cb5c64f7)

![](https://2658646806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M_7EhqBo_t9a-xYYzeH%2F-MdX97zsKza4nyvzh3Np%2F-MdX9uNmI36yUGPoM1xf%2Fimage.png?alt=media\&token=57eb4f61-5d95-4e74-96f0-0486e859d205)
