>> In this Module 3 video,
we'll be installing a universal forwarder.
As a review, a universal forwarder gets installed on
the machine you want to collect data
from and forwards it onto,
be indexed and used.
There are other ways to get data into Splunk,
but this is a popular and useful method.
At this point, there are few checks you should
do to make sure when you install the universal forwarder,
you're able to send the data you want onward.
You'll need to make sure there's a clear path of
communication between where you install
the universal forwarder and your Splunk server
and other splint components
when you decide to break it out and add more pieces.
Splunk by default also uses
several ports that will need to
be open and allowed for Splunk to work.
You also want to make sure that
the account you're using to set up Splunk
has the necessary permissions to
access the data you want to forward.
In this simple environment,
you'll need ports 9997 and
8089 unless you'd like to
change these from the default options.
This diagram from splunk.com
is helpful at visualizing the communication path.
In this video, we're focused down
here on the communication
between the universal forwarder,
indexers, and deployment server.
While t's important to know how
to go through a manual installation
of the universal forwarder,
another option to consider when
you get to a larger environment is
using a deployment tool like SCCM, Ansible, or chef.
To get started, I've got
two machines we'll be working from.
This Linux box is going to be my main Splunk server.
It holds the search head where we
can log into and run searches and
checks and also functions for
indexing and managing forwarders.
Then this Windows machine
is where we will be installing the universal forwarder.
To start off, I'm logged into splunk.com.
From here, we'll go to products,
Free Trial and download,
and then scroll down to where we
can download the universal forwarder.
Already downloaded it to save
us some time so I'm just going to hop into
my downloads folder here
and double-click on this shirt on it.
Except the licensing agreement, hit Next.
Create a username and password.
Like I mentioned, we're not
doing a distributed environment,
so our search head is
performing multiple roles including
that of a deployment server
so I put in the IP for that and
the default management IP of 8089 went next.
I'm also going to put it here as it works as an indexer.
Click Next and Install.
Click Yes on that and it's successfully installed.
I'm going to click Finish.
Once you've done the install,
something you'll probably want to do is
restart the Splunk servers.
I'm just going to open this up,
scroll down to Splunk for the service, Restart that.
Hop back to my Linux machine here.
We're going to go to Settings,
once we've logged into the web console and Forwarder
Management and it's not yet picking it up.
Sometimes it takes a second.
Let it there and do a couple of refreshes.
But now on the Forwarder Management we can
see this is the name of the host where
installed a universal forwarder
so it's successfully reporting
back to our deployment service/search head.
With that, we can say that we've
successfully completed the activity for this video.
The next video will be for Module 4,
we'll be working with data. Thanks for watching.