View source for Splunk

From Nuclear Physics Group Documentation Pages

← Splunk

You do not have permission to edit this page, for the following reason:

---

You can view and copy the source of this page.

Splunk is a flexible data aggregation system. In laymens' words, Splunk is a system that combs through log files (and anything else that contains structured information that you want to throw at it) and presents the results in a summarized format. It is really a pretty neat thing. See the [http://www.splunk.com splunk website]. == Splunk at NPG == At NPG we have the following setup: Taro = Splunk indexer, splunk deployment server, splunk web server Endeavour, Gourd, Einstein, Roentgen, Lentil, ... = Splunk forwarding servers. So, the other systems all forward their data to Taro, where it is indexed. The instructions of what to do by these forwarding hosts is also provided by Taro (deployment server). Additional indexing of data can be implemented by adding data to the deployment class on Taro. You can also add data directly on the node by editing the config files. Note: This means that even if you start the web interface on one of the other nodes, you won't see anything, since all the data was send to Taro. == Splunk 6.2.x == We are currently using Splunk version 6.2.2, which will be upgraded only as needed. == Accessing Splunk == The splunk web interface is available via port 8000 on Taro. This port is not open on the firewall so an ssh port forward should be used to access it. To do so use the following command: ssh -L 8001:localhost:8000 username@pumpkin Then direct your browser to https://localhost:8001 (you can change the 8001 to anything you want on both commands.) IF we are still using an "enterprise" license, you will be asked to enter a user name and password. Try "admin" and "changeme" or "splunkitnow" == Installing Splunk == This is changing with every release, fortunately it get easier. On Taro, Splunk is installed on /data/splunk/splunk-xxx with a link to the latest version. Taro also hosts the tar file. === Adding Forwarders === The process for installing a forwarder is pretty simple. Forwarders don't have a web interface, we turn it off, so use the following commands: # cd /opt # (or /data for systems with a data drive) # mkdir splunk # cd splunk # tar xzvf /net/data/taro/splunk/splunk-xxxx.tgx # cd splunk # bin/splunk start ## (agree to license) # bin/splunk edit user admin -password splunkitnow -role admin -auth admin:changeme # bin/splunk set deploy-poll 10.0.0.247:8089 ## (set deployment server as Taro) # bin/splunk enable boot-start # bin/splunk disable webserver # bin/splunk restart That's all folks. == Documentation == These links are useful references when setting up Splunk. [http://www.splunk.com/download/ Download Splunk] [http://docs.splunk.com/Documentation/Splunk/latest/Updating/Extendedexampledeployseveralstandardforwarders Example Deployment server] [http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Configuredeploymentclients Configure Deployment Clients (CLI examples)] [http://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonLinux Install on Linux] [http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Deployanixdfmanually Deploy *nix Universal Forwarder] [http://docs.splunk.com/Documentation/Splunk/latest/Admin/Changedefaultvalues#Changing_the_admin_default_password Change Admin pw from command line] [http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI Add files to monitor from command line]

Return to Splunk.