In our previous tutorial we saw how to install Splunk on indexer heavy forwarder deployment server and
search it for this tutorial will be using our local machine.
That is my laptop as a remote agent to.
They indexer in our cloud.
This is the Splunk for audit package, which is of latest 6x2.
The steps will be similar on any Windows platform.
Just check this box so that we are accepting license and there is a customized option to change the
default Splunk installation directory.
We have also seen the default Splunk home when we are going through the directory structure of Splunk.
This is your default Splunk home.
If you're installing full Splunk instance, it will be C program files Splunk.
For this tutorial, we'll be showing a demo of a Splunk universal forwarder installation, which is
similar to a Splunk enterprise.
So I'll keep this default setting as it is and I'll be clicking next.
The password it is asking here is for the SSL certificate.
This password, if we have SSL certificate like when we are hosting or sending it to cloud, we can
upload it here.
Or if we are using default Splunk generated certificate, we can leave this blank.
But I'll be running using local system account.
To what?
All we need to.
Let me enable everything so that we get most of the information to our Splunk insurgents.
And if you have any custom directory, let's say D or E direct E file systems where you need to monitor,
you can specify it in this part.
And also, if you're installing on Active Directory servers, make sure you check enable Active Directory
monitoring.
This is one of the important configuration like.
If you have a deployment server in your environment, you can mention the IP and hostname during the
installation.
We'll come to this part when we are configuring our deployment server.
How to add this configuration as part of the installation or as part of using Splunk CLI or using configuration
files as of now.
Leave this blank.
Continue.
Similarly, now it is asking for indexer.
Even indexer IP address will be coming to this part when we are configuring how to set up an indexer.
Then we'll be updating this configuration in your universal forwarder and we'll be showing three methods.
Splunk editing configuration.
And we have completed all this installation, but still those instances are not started up.
We are going to configure them one by one and start those instances.
So let this installation finish.
And we should be able to proceed with the configuration of these installation.