Splunk Installation

splunk is a powerful tool used in cybersecurity for collecting, indexing,

searching, and analyzing vast amounts of machine-generated data from
various sources such as network traffic, server logs, application logs,
and more. It helps security teams to detect and respond to security
threats effectively by providing real-time visibility into the security
posture of an organization's IT infrastructure. Splunk's capabilities
enable security analysts to identify patterns, anomalies, and potential
security incidents, investigate security breaches, and streamline incident
response processes. Overall, it's a crucial tool for monitoring, managing,
and enhancing the security of digital environments.

1) Download the splunk from official website

https://www.splunk.com/

Click on the free splunk option, it will take you the sign-up page
 2)Create an splunk account

Fill in all the details to create a Splunk account

3)After creating an account, log in to your Splunk account

Note: Perform all these steps in your windows server

Click on the downloads page

4)Select the Splunk Enterprise Free Trial option
5)Select windows version and click on download

Make sure you download the Splunk server from your Windows Server 2019,
which is installed in the VMware

Now the download has started, it will take some time

6) After downloading the file, run it.

Accept the license Agreement, then click on next

7) Create an admin account for splunk dashboard

Create a strong username and a strong password.

Click on Install

It will take some time

"Now that the installation is completed, click on 'Finish'."

Now, it will launch the Splunk portal.

Now, enter the credentials you created earlier and click on 'Sign In

The installation is now completed, and you can begin using Splunk.
Splunk Forwarder
Splunk forwarder, simply put, is a component of the Splunk data
processing architecture. It's responsible for collecting, forwarding, and
indexing machine data such as logs, events, and metrics from various
sources to a Splunk deployment for analysis and visualization.
Forwarders are lightweight agents that are installed on the machines
generating the data. They continuously monitor designated files or
streams, extract relevant information, and send it securely to the Splunk
indexer or indexer cluster for storage and analysis. This helps
organizations centralize their machine data, gain insights, and take
action based on real-time information.
1)Download The splunk universal forwarder
https://www.splunk.com/en_us/download/universal-forwarder

Log in to your account and click on free splunk

2) Navigate to the downloads page.

Click on 'Get my free Download' under Universal Forwarder.

4) Select windows version

Select the Windows version and click on 'Download Now'.

The download has started; it will take some time.

5)After downloading the file, run it

Accept the license agreement and select on-premises and click on next
6)create an account for the splunk forwarder

7)Deployment server

Leave hostname and port empty and click on next

8)Receiving indexer

Enter your splunk server Ip address and port number is 9997

Click on install

The installation process is started it will take some time

9) log in to your splunk portal
10) configure receiving port

Click on settings and click on forwarding and receiving

 Click on add new

Enter 9997 port and click on save

11) open a command prompt with administrator privileges.

Navigate to the directory where the Splunk Universal Forwarder is installed

Default path C:\Program Files\SplunkUniversalForwarder\bin

13) Configure the Splunk Universal Forwarder to send logs to your Splunk
indexer
Replace <indexer_host> with the hostname or IP address of your Splunk
indexer and <port> with the receiving port of your Splunk indexer.

Enter the username and password

14) Add the logs you want to forward

15) start splunk

16) Verify that logs are being forwarded successfully

Log in to your splunk portal

Click on searching and reporting

Here, we can see that the logs are being forwarded from Windows to the
Splunk server.
Splunk monitor
1)Log in to your splunk portal

Click on add data

2)monitor
3)local event logs

Click on local event logs and select the type of logs you want to
monitor

Click on review
Click on submit
4)verify the data

Click on start searching

"We can see that the security logs are being forwarded from
Windows to our Splunk server."