Configure Splunk Universal Forwarder on Ubuntu

ConfigureSplunkForwarder.sh

## Download the splunk universal forwarder
# Would probably need to login to splunk first.
wget -O splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.3.3&product=universalforwarder&filename=splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb&wget=true'

## install
# It gets installed in /opt/splunkforwarder
sudo dpkg -i splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb

## add the entry to init.d


## Change password
sudo /opt/splunkforwarder/bin/splunk edit user admin -password mypassword -auth admin:changeme

## Configure the data to go to an indexer 
sudo ./splunk add forward-server splunkserver:9997 -auth admin:mypassword

## Add files to monitor
sudo /opt/splunkforwarder/bin/splunk add monitor /var/log -auth admin:mypassword

## bouce if required
sudo /opt/splunkforwarder/bin/splunk restart

## configure init.d
sudo /opt/splunkforwarder/bin/splunk enable boot-start