Tuesday, March 15, 2016

Splunk Installation on centOS minimal server


CentOS setup :


1. Download CentOS minimal from mirrors at
    http://isoredirect.centos.org/centos/7/isos/x86_64/CentOS-7-x86_64-Minimal-1511.iso

2. Perform regular installation using iso file.
3. Setup network commands tools by executing : 
    yum install net-tool

4. Update all the packages using command  : 
    yum update

5. Download splunk rpm from below site. You may need to create account .
    https://www.splunk.com/en_us/download/splunk-enterprise.html
6. Install splunk by executing command : 
    rpm -ivh

7. This package will be installed at path /opt/splunk
8. Start splunk by executing below command  
    /opt/splunk/bin/splunk start
9. Accept the License and type y --> this is only for the first time.
10. Execute the below command to open port 8000 so that splunk can be accessed from outside
      firewall-cmd --zone=public --add-port=80/tcp --permanent
      firewall-cmd --reload
11. Verify the setting :
       iptables-save | grep 80

      Output should match like : 
     -A IN_public_allow -p tcp -m tcp --dport 8000 -m conntrack --ctstate NEW -j ACCEPT

12. Try accessing splunk console URL from outside