[LINUX] Send log data from the server to Splunk Cloud

Introduction

I had the opportunity to use Splunk Cloud. Therefore, I will leave a memorandum on how to transfer various logs from the Linux server.

This article is based on Get * nix data into Splunk Cloud

Advance preparation

-Register in Splunk Cloud --Free trial is okay --Prepare an instance of Linux --We have confirmed the operation with Wordpress in the GCP Marketplace.

procedure

Install Universal Forwarder on the server
Download and install Universal Forwarder credentials
Install Add-on for Linux on Universal Forwarder
Install the App to parse the Add-on installed in 3.
Confirm that the data can be received

1. Install Universal Forwarder on the server

After logging in to splunk.com, download the Universal Forwarder from here (https://www.splunk.com/en_us/download/universal-forwarder.html). Click Download Now for your favorite package. After accepting the terms, you can get commands that can be executed from within the instance by pressing Download via Command Line (wget).

$ cd /tmp
$ wget ... #The command you got earlier
#Get the package that suits your environment
$ sudo rpm -i splunkforwarder-<…>-linux-2.6-x86_64.rpm 
$ sudo dpkg -i splunkforwarder-<…>-linux-2.6-x86_64.deb
#After installation, the splunk user will be added
$ sudo su - spulnk
$ cd /opt/splunkforwarder/bin
$ ./splunk start
#You will be prompted for your username and password.
#splunk because it is used by splunk forwarder.It's okay with something different from com
#Exit when the following is displayed
All installed files intact.
Done
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
Done

2. Download and install Universal Forwarder credentials

Go to https: // <your instance> .splunkcloud.com / ja-JP / app / splunkclouduf / setupuf
Download the credentials from 3. Download your customized universal forwarder credentials package.
Transfer the downloaded credentials to your instance via sftp etc.

$ pwd
<PATH-TO-FILE>
$ ls
splunkclouduf.spl
$ sudo su - splunk
$ /opt/splunkforwarder/bin/splunk install app <PATH-TO-FILE>/splunkclouduf.spl
#If you are prompted for a username and password, enter the one you just mentioned

#Installation is complete when the following message is displayed.
App '<PATH-TO-FILE>/splunkclouduf.spl' installed

#Restart the universal forwarder
$ ./splunk restart

3. Install Add-on for Linux on Universal Forwarder

You can extend the functionality by downloading the Add-on from Splunkbase and installing it in the forwarder. This time, we will introduce Splunk Add-on for Unix and Linux. By introducing this Add-on, you can set the transfer of various logs in the Linux environment.

Download the Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833/).

Work in the terminal below

# /Downloads/splunk-add-on-for-unix-and-linux_602.Add to tgz-Suppose on is downloaded

#Copy the tar file downloaded to the instance using scp etc.
$ scp splunk@<LINUX_INSTANCE_IP_ADDR>:/tmp/ /Downloads/splunk-add-on-for-unix-and-linux_602.tgz

#Log in to your Linux instance. Below this, work with your Linux instance.
$ ssh splunk@<LINUX_INSTANCE_IP_ADDR>
$ cd /tmp
$ tar xvfz splunk-add-on-for-unix-and-linux_602.tgz

# Splunk_TA_Make sure you have a directory called nix
$ ls

# splunkforwarder/etc/Move to apps
$ mv Splunk_TA_nix/ /opt/splunkforwarder/etc/apps
$ cd /opt/splunkforwarder/etc/apps/Splunk_TA_nix

#Copy the config file
$ mkdir local
$ cp default/inputs.conf local

#setting file
$ cat local/inputs.conf | head -n 6
# Copyright (C) 2020 Splunk Inc. All Rights Reserved.
[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
disabled = 1

# disabled =Data can be transferred by setting it to 0.
$ sed -e 's/disabled = 0/disabled = 1/g' local/inputs.conf > local/inputs.conf
$ sed -e 's/disabled = true/disabled = false/g' local/inputs.conf > local/inputs.conf

#After making changes, reboot
$ cd /opt/splunkforwarder/bin
$ ./splunk restart

4. Install the App to parse the Add-on installed in 3.

After completing the above settings, the data from Linux has already been sent. However, some of the data has not been parsed, so it is difficult to use as it is. That's why we're introducing the Splunk Add-on for Unix and Linux to Splunk Cloud. Data can be parsed by introducing this Add-on.

From the top left of Splunk Cloud, select `Search for other apps``
Search for Splunk Add-on for Unix and Linux and install it.

5. Confirm that the data can be received

If the settings are correct, the top result will be parsed and displayed like this.

Reference link

Get *nix data into Splunk Cloud