#Installing splunk forwarder on linux install#
#Installing splunk forwarder on linux password#

If it was my script and it was meant to be universal I'd do a conditional check for existence of old forwarder and a command-line switch to force removal in case of pre-existing dir.Ģ) Sure it doesn't it simply connects to a server and pulls a file from there. It's just that I'm already old and grumpy and like well-written stuff so I point out what can be done better.ġ) No. #adds the deployment server for managing the newly created instance (optional but defnitely should use a deployment server)Įcho '' | sudo tee -a /opt/splunkforwarder/etc/system/local/nfĮcho 'targetUri = NAME_OF_DEPLOYMENT_SERVER:8089' | sudo tee -a /opt/splunkforwarder/etc/system/local/nfįirst things first - it's not to say that the script does 't work or anything like that. optional however and can be configuredĮcho '' | sudo tee -a /opt/splunkforwarder/etc/system/local/nfĮcho 'disabled = 0' | sudo tee -a /opt/splunkforwarder/etc/system/local/nf #adds the monitoring of var/log/syslog (relatively important for monitoring linux (ubuntu) servers. #Adds the instance of where you are going to be forwarding your logsĮcho '' | sudo tee -a /opt/splunkforwarder/etc/system/local/nfĮcho 'defaultGroup = default-autolb-group' | sudo tee -a /opt/splunkforwarder/etc/system/local/nfĮcho '[tcpout:default-autolb-group' | sudo tee -a /opt/splunkforwarder/etc/system/local/nfĮcho 'disabled = false' | sudo tee -a /opt/splunkforwarder/etc/system/local/nfĮcho 'server = NAME_OF_YOUR_SPLUNK_SERVER:9997' | sudo tee -a /opt/splunkforwarder/etc/system/local/nf splunk start -accept-license -no-prompt -gen-and-print-passwd

#Installing splunk forwarder on linux password#

# generates random password for admin account # Edit this section to get the most recent up to date wget command for downloading splunk forwarder # This will delete the installation of splunk forwarder if there already is one installed. In case this may be useful to anyone who comes across this thread in the future #!/bin/bash

#Installing splunk forwarder on linux install#

This is an old version of a script I use to install splunk forwarder on Linux (ubuntu) servers and connect up to a splunk enterprise instance and deployment server.