IT & IoT Security | Cloud | It's all about the life itself

Hi all,

I assume you have a valid Splunk account (you can register on splunk.com) , have virtualbox(or a similar hyervisor) or have valid Azure/AWs/GCP subscription where you can spin up VM’s.

After you have spun up a centos VM , run yum update

Reboot you VM as applicable.

Run below command to download splunk distribution.

wget -O splunk-8.0.2.1-f002026bad55-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.0.2.1&product=splunk&filename=splunk-8.0.2.1-f002026bad55-linux-2.6-x86_64.rpm&wget=true'

You can have the latest release from splunk.com

After you have downloaded the setup file , rpm installer as shown below.

rpm -i splunk-8.0.2.1-f002026bad55-linux-2.6-x86_64.rpm
rpm -U splunk_package_name.rpm (if you upgrading your existing environment)

Next step, move to /opt/splunk/bin and start the daemon.

./splunk start --accept-license

You will be asked to provide administrator account name and password. This account will be your splunk application level admin account.

[Optional] You would like set it to start automatically on boot.

./splunk enable boot-start

If everything has gone well , you would have splunk web console url ending with :8000 port (default). You can also ssh to your vm. It may require additional firewall/NSG/SG port configuration. For example, if you have set it up on Azure, you have to add TCP 8000 port in to network security group which was created for that particular VM/Network.

Regards