splunk forwarder 간편한 설치 스크립트

1-1. Linux용 - root로 실행하며, 현재 경로에 splunkforwarder*.tgz 파일이 있어야 합니다.

위 쪽 export 부분은 서버 환경에 맞게 변경해야 합니다.

export SPLUNK_USER="계정명"
export SPLUNK_USERPWD='계정암호'
export SPLUNK_DEP_SVR="IP:포트1"
export SPLUNK_FWD_SVR="IP:포트2"
export USER_BASEDIR="/home"
export SPLUNK_DIR="$USER_BASEDIR/$SPLUNK_USER"
export SPLUNK_HOME="$SPLUNK_DIR/splunkforwarder"
groupadd $SPLUNK_USER
useradd -g $SPLUNK_USER -s `getent passwd root | awk -F: '{print $7}'` -m -d $SPLUNK_DIR $SPLUNK_USER
echo "$SPLUNK_USER:$SPLUNK_USERPWD" | chpasswd
echo "export SPLUNK_HOME=\"$SPLUNK_HOME\"" >> $SPLUNK_DIR/.bashrc
mv splunkforwarder*.tgz $SPLUNK_DIR
cd $SPLUNK_DIR
tar xvfz splunkforwarder*.tgz
echo "[user_info]" > $SPLUNK_HOME/etc/system/local/user-seed.conf
echo "USERNAME = "$SPLUNK_USER >> $SPLUNK_HOME/etc/system/local/user-seed.conf
echo "PASSWORD = "$SPLUNK_USERPWD >> $SPLUNK_HOME/etc/system/local/user-seed.conf
chown -R splunk:splunk $SPLUNK_HOME
su - splunk -c "$SPLUNK_HOME/bin/splunk start --accept-license --answer-yes --no-prompt; sleep 5; $SPLUNK_HOME/bin/splunk set deploy-poll $SPLUNK_DEP_SVR; $SPLUNK_HOME/bin/splunk add forward-server $SPLUNK_FWD_SVR"
### SPLUNK ID / PASSWORD 입력 ###
su - splunk -c "$SPLUNK_HOME/bin/splunk stop"
sleep 1;
$SPLUNK_HOME/bin/splunk enable boot-start -systemd-managed 1 -user splunk
systemctl start SplunkForwarder
systemctl status SplunkForwarder

 

1-2. Linux 삭제

$SPLUNK_HOME/bin/splunk disable boot-start
userdel -r splunk

 

2-1. Solaris용 - root로 실행하며, 현재 경로에 splunkforwarder*.Z 파일이 있어야 합니다.

위 쪽 export 부분은 서버 환경에 맞게 변경해야 합니다.

export SPLUNK_USER="계정명"
export SPLUNK_USERPWD='계정암호'
export SPLUNK_DEP_SVR="IP:포트1"
export SPLUNK_FWD_SVR="IP:포트2"
export USER_BASEDIR="/home"
export SPLUNK_DIR="$USER_BASEDIR/$SPLUNK_USER"
export SPLUNK_HOME="$SPLUNK_DIR/splunkforwarder"
groupadd $SPLUNK_USER
useradd -g $SPLUNK_USER -s `getent passwd root | awk -F: '{print $7}'` -m -d $SPLUNK_DIR $SPLUNK_USER
echo "export SPLUNK_HOME=\"$SPLUNK_HOME\"" >> $SPLUNK_DIR/.profile
mv splunkforwarder*.Z $SPLUNK_DIR
cd $SPLUNK_DIR
uncompress *.Z
tar xvf splunkforwarder*.tar
echo "[user_info]" > $SPLUNK_HOME/etc/system/local/user-seed.conf
echo "USERNAME = "$SPLUNK_USER >> $SPLUNK_HOME/etc/system/local/user-seed.conf
echo "PASSWORD = "$SPLUNK_USERPWD >> $SPLUNK_HOME/etc/system/local/user-seed.conf
chown -R splunk:splunk $SPLUNK_HOME
su - splunk -c "$SPLUNK_HOME/bin/splunk start --accept-license --answer-yes; $SPLUNK_HOME/bin/splunk stop"
su - splunk -c "$SPLUNK_HOME/bin/splunk set deploy-poll $SPLUNK_DEP_SVR"
su - splunk -c "$SPLUNK_HOME/bin/splunk add forward-server $SPLUNK_FWD_SVR"
$SPLUNK_HOME/bin/splunk enable boot-start
/etc/init.d/splunk start
passwd splunk
### SPLUNK ID / PASSWORD 입력 ###

 

2-2. Solaris 삭제

$SPLUNK_HOME/bin/splunk disable boot-start
userdel -r splunk
groupdel splunk