Detailed configuration of network security "Splunk" in national vocational college skills competition

Network security competition discussion group , You can enter it intentionally , Buckle group number is 809706080, You can ask questions in the group .

First, enter the server terminal to decompress rpm Installation package
Wait for installation to complete

/opt/splunk/bin/splunk restart ` restart splunk

Keep blank until the following page appears to enter y

Input login splunk Account and password at , The password length cannot be less than 8 position

Access to the server 8000 port , Enter the set account and password

Click forward and receive in the settings in the upper right corner

Click Add

Fill in port number , Save it

install splunkforward Check Check this box to accept, Click on Customize Options

The default path is OK

Select the corresponding log according to the requirements of the topic

user admin, Remove the randomly generated password option √, Fill in the password ,

Fill in linux Of ip, port 8089

fill linux Of ip, port 9997 Yes, just now Linux Set the port number of forwarding on

Wait for installation to complete

Get into splunk Installation directory
perform splunk.exe add forward-server 192.168.227.194:9997
Enter the set user name and password

stop it splunk
perform splunk.exe stop

start-up splunk
perform splunk.exe start

Switch to web Manage Pages
Find the forwarder instance deployment

Click on setup

Click enable , Save it

Wait two minutes to refresh the page , The following page appears