Splunk enterprise on Ubuntu

splunk enterprise

# misc.
./splunk install app -update 1 -auth :

By default, splunk ports are listening on all iterfaces with port 8000, and 127.0.0.1 with port 8065... this can be modified by tinkering with /opt/splunk/lib/py*/site-packages/splunk/appserver/mrsparkle/root-py --proxied=...
 splunk/kvstore/mongo
 
# To start splunk daemon
sudo /opt/splunk/bin/splunk start

# To make local Linux splunk instance available online
autossh> autossh -M0 -fN -i ~/.ssh/id_rsa -R 1217:localhost:8000 -p 2220 [email protected]

# Custom Scripting in Splunk
> cd /opt/splunk/bin/scripts/
> touch get_apache_logs.sh && chown splunk:splunk get_apache_logs.sh  && chmod 555  get_apache_logs.sh  && nano ./get_apache_logs.sh
---- x ----
#!/bin/bash
# Sample apache logs in real-time
curl -s http://accenture.0x10.info/hackfoward/splunk/stream.php
---- x ----
> ./get_apache_logs.sh