SPLUNK (1)

Installing and Configuring Splunk Enterprise on Ubuntu

Splunk is a tool that helps organizations collect, search, and analyse data from IT systems — like servers, applications, and network devices.

It takes large volumes of machine data (like logs), organizes it, and makes it easy to:

• Monitor systems in real time
• Troubleshoot problems
• Improve performance
• Detect security issues

Splunk also allows users to create dashboards, reports, and alerts, making it easier to understand what’s happening across your technology environment.

Supported Operating Systems for Splunk Enterprise

• Linux (Most common for production): Ubuntu (20.04, 22.04 LTS), CentOS/RHEL, Debian, SUSE Preferred for performance, scalability, and control.
• Windows: Windows 10/11, Windows Server 2016/2019/2022 Good for development and smaller setups.
• macOS: Monterey, Ventura, etc. For development/testing only; not recommended for production.
• Cloud Platforms: AWS, Azure, Google Cloud Use Splunk Cloud (SaaS) or self-hosted.

Ubuntu Version Used

We are using Ubuntu 20.04 LTS, which offers long-term support, stability, and regular security updates.

Instead of using an ISO file, we deploy Ubuntu on VMware using a pre-configured VMDK image, which simplifies and speeds up the virtual machine setup process.

Let’s start the installation of Ubuntu in VMware for Splunk.

• Search for “Ubuntu VMDK” on Google.
• Choose the website OSBoxes.org from the results.

img.1(searching)

• When you open the OSBoxes website, you will see multiple versions of Ubuntu available for different virtualization platforms such as VirtualBox and VMware.
• For our setup, we are using Ubuntu 20.04.

img.2(Ubuntu 20.04)

Step: Creating a New Virtual Machine

• After the installation is complete, open VMware Workstation.
• On the home page, click on “Create a New Virtual Machine” to begin the setup process.

img.3(for new virtual machine)

img.4 (for basic uses)

img.5 (for later install)

img.6(operating system)

img.7(VM name(can also named as Ubuntu(Splunk))

img.8(storage)

img.9(final overview)

img.10(edit the settings)

img.11(for auto detect)

img.12(click on add)

img.13(choose hard disk)

img.17(choose SCSI)

img.18(click on existing virtual disk)

img.19(click on browser)

img.20(go to vmdk save folder and click on vmdk )

img.21(click on finish)

img.22(click on existing format)

img.23(start the machine )

USERNAME & PASSWORD

The VMDK file comes with a pre-configured user and password because it’s a ready-to-use OS image. This allows users to log in immediately without going through the installation process.

Username:- osboxes.org

Password :- osboxes.org

img.24(enter password)

open terminal :- Ctrl + Alt + T

Update and Upgrade Ubuntu

• sudo apt update – Refreshes the list of available packages.
• sudo apt upgrade -y – Installs the latest versions of the packages automatically (-y skips confirmation).

img.25(enter osboxes.org as password)

The Ubuntu environment is now successfully set up and ready for use.

Configuring Splunk on Ubuntu

1. Download Splunk

• Open Google and search for Splunk
• Visit the official Splunk website and select “Splunk Enterprise 60-day free trial”.

img.26

Fill in the required details such as your name, email address, company, and job role to proceed with the download.

img.27

img.28(after fill up)

Open the email and click on the “Verify Your Email” button to confirm your account.

img.29(email of verification)

Select the OS of System

img,30(copy the command)

Open VMware and start the Ubuntu virtual machine.

Once the system is running, copy the Splunk installation command and paste it into the terminal to begin the installation process.

img.31(paste the command)

Check if the Splunk .deb package has been successfully downloaded to your system.

img.32(use “ls” command)

Open the terminal and run the command to install the .deb package using the dpkg tool.

img.33(install of .deb package)

When running Splunk for the first time, you will be prompted to accept the license agreement.

After that, set the admin username and password to complete the initial setup.

img.34(set up username & password)

To ensure Splunk starts automatically every time the system boots

img.35(enable)

Open Firefox on your Ubuntu system.

In the address bar, enter the following URL to access the Splunk dashboard: 👉 [http://osboxes:8000](http://osboxes:8000)

img.36(enter Username & Password)

On the Splunk login page, enter the username and password you created during the initial setup.

Click “Sign In” to access the Splunk web interface.

img.37(interface of Splunk)

Task Command

Start Splunk sudo /opt/splunk/bin/splunk start

Stop Splunk sudo /opt/splunk/bin/splunk stop

Restart Splunk sudo /opt/splunk/bin/splunk restart

Enable Splunk on Boot sudo /opt/splunk/bin/splunk enable boot-start

Check Splunk Status sudo /opt/splunk/bin/splunk status

View Splunk Version sudo /opt/splunk/bin/splunk version