如何在Ubuntu 18.04 LTS上安装Splunk Log Analyzer

Splunk是一个功能强大的日志数据库，可用于通过Web界面搜索，监控和分析机器生成的大数据。它是分析，探索和搜索数据的非常有用的工具。您可以使用Splunk从应用程序，Web服务器，数据库，服务器平台，云网络等等实时索引，搜索，收集和可视化大量数据流。

Splunk由 三个主要组件组成：

Splunk Forwarder：它用于收集日志。
Splunk索引器：它用于解析和索引数据。
Splunk搜索头：提供用于搜索，分析和报告的Web界面。

在本教程中，我们将学习如何在Ubuntu 18.04 LTS（仿生海狸）服务器上安装Splunk。

要求

运行Ubuntu 18.04到您的系统的服务器。
具有sudo权限的非root用户。

安装Splunk

Splunk支持各种操作系统，包括Windows，Linux，FreeBSD，OSX，Solaris，AIX等等。您可以从其官方网站下载最新版本的Splunk或使用以下命令：

wget https://download.splunk.com/products/splunk/releases/7.1.1/linux/splunk-7.1.1-8f0ead9ec3db-linux-2.6-amd64.deb

下载完成后，使用以下命令安装下载的文件：

sudo dpkg -i splunk-7.1.1-8f0ead9ec3db-linux-2.6-amd64.deb

安装成功完成后，您应该看到以下输出：

(Reading database ... 218552 files and directories currently installed.)
Preparing to unpack splunk-7.1.1-8f0ead9ec3db-linux-2.6-amd64.deb ...
Unpacking splunk (7.1.1) over (7.1.1) ...
Setting up splunk (7.1.1) ...
complete

接下来，您需要启用Splunk服务才能在启动时启动。您可以通过运行以下命令来完成此操作：

sudo /opt/splunk/bin/splunk enable boot-start

在这里，您需要同意许可协议并提供管理员密码，如下所示：

Splunk Software License Agreement 04.24.2018

Do you agree with this license? [y/n]: y

This appears to be your first time running this version of Splunk.

An Admin password must be set before installation proceeds.
Password must contain at least:
   * 8 total printable ASCII character(s).
Please enter a new password: 
Please confirm new password: 
Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/etc/openldap/ldap.conf'.
Generating RSA private key, 2048 bit long modulus
..................+++
..............................................................................+++
e is 65537 (0x10001)
writing RSA key

Generating RSA private key, 2048 bit long modulus
.............+++
...................................+++
e is 65537 (0x10001)
writing RSA key

Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/opt/splunk/share/splunk/search_mrsparkle/modules'.
 Adding system startup for /etc/init.d/splunk ...
   /etc/rc0.d/K20splunk -> ../init.d/splunk
   /etc/rc1.d/K20splunk -> ../init.d/splunk
   /etc/rc6.d/K20splunk -> ../init.d/splunk
   /etc/rc2.d/S20splunk -> ../init.d/splunk
   /etc/rc3.d/S20splunk -> ../init.d/splunk
   /etc/rc4.d/S20splunk -> ../init.d/splunk
   /etc/rc5.d/S20splunk -> ../init.d/splunk
Init script installed at /etc/init.d/splunk.
Init script is configured to run at boot.

接下来，使用以下命令启动Splunk服务：

sudo service splunk start

您应该看到以下输出：

Starting splunk server daemon (splunkd)...  
Generating a 2048 bit RSA private key
............+++
............................................................................................................................................+++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=Node3/O=SplunkUser
Getting CA Private Key
unable to write 'random state'
writing RSA key
Done


Waiting for web server at http://127.0.0.1:8000 to be available........ Done


If you get stuck, we're here to help.  
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://Node3:8000