Scribd
Upload
30 views25 pages

Splunk Quick Userguide V2

Uploaded by

paleologos
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
30 views25 pages

Splunk Quick Userguide V2

Uploaded by

paleologos
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 25

.:|:.:|:.

cisco

Introduction and purpose:


This document provides details steps for deploying Splunk version 4.2 and 4.3 release,
Configuring and Implementing Splunk software and uploading Splunk for Cisco Ironport WSA
APP (SplunkforCiscoIronportWSA). In addition it contains command line (CLI) details for
Splunk services and verification of connectivity/operation with screen capture/snapshot for
visual review.

Components Used:
The information in this document is based on Windows 2008 R2 server and Splunk version 4.3
Build 115073.

Document Audience:
This documentation is primarily for Customer support engineers, Sales Engineers and customers
who are engage in planning, deploying/implementing, and configuring Splunk in Windows or
Unix/Linux environment.

System Requirements:
Splunk Advanced Web Reporting runs on Windows and Red Hat Linux. There is no support for
virtualization for production instances of Splunk Advanced Web Reporting. Reference hardware
can be commodity-grade with the minimum specifications below.
• Intel x86 64-bit chip architecture with 2 CPUs, 4 cores per CPU, and 2.5 to 3 GHz per core.
• 16 GB RAM
• (4) 300-GB SAS hard disks at 10,000 rpm each in RAID 10 (800 IOPS or better)
• (1) Gigabit Ethernet network interface card (NIC). A second NIC for a management network is
recommended
Note: These hardware specifications are recommended for an organization with more than
25,000 users. Please talk to your account team to understand the hardware specifications you
will need to run Splunk Advanced Web Reporting at your organization.
Step 1:
Download Splunk from www.splunk.com

Step 2:
Install Splunk on the local host/server.

Step 3:
Once the installation is completed logon via Splunk GUI for the first time, and change admin
password.
Step 4:
Enter username: admin password changeme, and enter desired password for admin account for
subsequent logins.
This will bring you to the Splunk Welcome/Home/default Screen.
Step 5
Add Splunk permanent License via Splunk GUI: (default license is for 30 days 500 MB indexing
per day)

Manager » Licensing » Add new license > copy & paste the license XML directly...
Copy and paste license file and click on install
Following Screen appears:
Click on “restart now”, follow the screen:
Once the Splunk is up, log back in and verify the License status (indexing volume per day,
expiration etc...)
Manager » Licensing verify the expiration date (screen below show 500 MB per day expiration
Jan 18, 2038)

Step 6:
Upload “SplunkforCiscoIronportWSA” APP (APP file is available on Cisco Portal file
name “SFCIW_v1.0.37.tar (link below)):
http://www.cisco.com/cisco/software/release.html?mdfid=282803425&flowid=4951&software
id=283998384&release=Splunk%20Reporting%20SW&relind=AVAILABLE&rellifecycle=&reltype
=all

From Splunk GUI:


Splunk > Manager » Apps » Upload app
Once the app loaded review the Splunk home screen shows “SplunkforCiscoIronportWSA” (see
below)
Step 7:
Add data source from Splunk GUI: (in following example WSA pushing the access logs to Splunk
server via ftp to “C:\splunklogs\wsaaccesslogs\wsaone-accesslogs”
Please note: Each WSA will required to have it’s own logs directory for optimal results and for
successful search within the Splunk
From Splunk GUI:
Manager » Data inputs » Files & directories » Data preview > Skip preview (manually configure
your input) > Continue
That will bring you the Screen as follows:

MUST check “Continuously index data from a file or directory this Splunk instance can access”,
provide path and check “More setting”

Configure following values under “More setting”:


Host field value (this is WSA hostname e.g. if this is first WSA access logs path then enter the
WSA actual hostname)
Set the source type (choose “Manual” from the drop down), and under “Source type” enter
wsa_accesslogs (for access logs and wsa_trafmonlogs for L4TM logs)
IMPORTANT: PLEASE NOTE ONCE SPLUNK READ AND INDEX WSA “ACCESSLOGS” OR “TRAFMONLOGS”
IT WILL DELETE THESE LOGS (DEFAULT BEHAVIOR), IF THE INTENTION IS TO “RETAIN” THESE LOGS
FOR AUDIT OR ANY OTHER REASONS. WE NEED TO STAGE/SAVED THESE LOGS ON AN FTP SERVER
NOT ON LOCAL DRIVE/PATH WHERE SPLUNK IS INSTALLED.
Clicks save on the bottom of the page, and repeat this step for each WSA access logs and L4TM
logs,
We *should * see Data input similar to following screen:
Step 8: Add WSA historical access logs and L4TM logs in to Splunk, Two steps process:
8.1 Copy logs in to Appropriate WSA access logs or L4TM logs directory
8.2 Run summary.vbs/sh from Splunk CLI

Once the logs are moved to appropriate logs directory, Execute step 2 from Splunk CLI,

Run summary.vbs/sh from (see above screen shot)


C:\“Program Files\Splunk\etc\apps\SplunkforCiscoIronportWSA\bin>”

When prompt point to “Splunk” directory under c:\ Program Files\Splunk and enter Splunk
admin credentials
Screen Similar to below will appear and let it run in the background, once this process is
completed. ALL historical logs will be imported in to Splunk database:

Please note it *may* take a while, and all depends how much historical logs data have to be
process by Splunk,
Once the Summary run completed we should start seeing current and historical data (see
below):
Other Resources:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/WhatisSplunkknowledge >
Splunk knowledge base (KB)
http://answers.splunk.com > Splunk Blog, FAQ, Wiki Documentations, Splunk Community, post
questions etc.
http://splunk-base.splunk.com/answers/ > Find an Answer for common Splunk issues
http://splunk-base.splunk.com/ask/ > Post a questions to Splunk
http://www.splunk.com/support/list/forum > Splunk Forums
http://docs.splunk.com/Documentation/Splunk > Splunk version specific documentations
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume > Troubleshooting
Indexed Data Volume
http://www.cisco.com/cisco/software/type.html?mdfid=282803424&flowid=4950

Splunk Video KB FAQ here:


http://www.splunk.com/videos
http://www.splunk.com/base/documentation
www.splunk.com > Current Splunk versions

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy