Creating an Instance on AWS
Go to AWS (https://aws.amazon.com/)
Sign in
In Search Tab look up “EC2”
Click “Launch Instance”
AWS Instance Setup Name - whatever you’d like.. “Demo” for example
Application and OS Images - Amazon Linux
Instance Type - Change to t2.medium
Key Pair
Create a new key pair
Key Pair Name: “Demo” for example
Make sure to choose pem. File
Network Settings
Firewall(Security groups) : Create Security Group
Ensure Allow SSH Traffic From is checked
Select my IP
Configure Storage
1 x 25 GiB (gp3)
Click Launch Instance to the right (----> Orange Button)
Configuring Security Groups
Go Back to EC2 and click on your demo instance
Go to security at the bottom of the page
Click Security Groups that is attached
EXAMPLE: sg-077b35a0671d89ac7 - launch-wizard-25
Click on edit inbound rules
Click on Add rule
Put the following in the boxes as it appears
Type: Custom TCP
Port Range: 8000
Source: My IP
Description : Splunk Web Port
Click Save Rules
AWS Security Group
SSH Into the Terminal
In AWS, go to EC2 Instances Page
Click on your demo instance
Click Connect
Connecting To Splunk Instance Select SSH Client
Step by Step Instructions how to log into your AWS instance from your SSH
SSH Client Steps
Open up your SSH Terminal
Locate where your PEM file is that you downloaded from AWS.
For most computers, it's saved in your Downloads Folder/Directory
If using MAC Terminal
Run the following to make sure your fie is here.
chmod 400 "YOUR DOWNLOADED PEM FILE.pem"
(EXAMPLE - chmod 400 "Environment.pem")
ssh -i "/Users/<YOUR USERNAME ON YOUR MAC>/Downloads/<YOUR PEM FILE NAME>" ec2-user@ec2-54-86-34-135.compute-1.amazonaws.com
(EXAMPLE: ssh -i "/Users/treysplunks/Downloads/Environment.pem" ec2-user@ec2-54-86-34-135.compute-1.amazonaws.com)
If you are using Windows PC SSH Client (MobaXterm ideally)
ssh -i "C:\\Users\<YOUR USERNAME ON YOUR MAC>\Downloads\<YOUR PEM FILE NAME>" ec2-user@ec2-54-86-34-135.compute-1.amazonaws.com
(EXAMPLE: ssh -i "C:\Users\treysplunks\Downloads\Environment.pem" ec2-user@ec2-54-86-34-135.compute-1.amazonaws.com)
Logging into Splunk from a Linux/AWS Terminal
After creating an EC2 instance in AWS and logging into the Server you created in AWS
Log into Splunk.com and go to Free Downloads and Splunk Enterprise Download
Splunk.com Downloading Splunk Click on Linux and choose the WGET copy link next to the .rpm extension
Go back to the Terminal where you have your SSH session into your Splunk Server going.
You should currently be the ec2-user. Become root by running the following command
sudo su
Change directories and go to /tmp as this is the normal location for all temporary files. Run the following commands
cd /tmp
Let us ensure that wget is installed by running the following commands (The WGET command downloads the packages of Splunk Enterprise directly from Splunk.com Repository)
man wget (if a manual page comes up, WGET is installed. To exit press q.)
If you do not have wget already installed, you can install it by running
yum install -y wget
Paste your WGET command from clipboard that was copied from Splunk Enterprise
EXAMPLE: wget -O splunk-9.4.0-6b4ebe426ca6.x86_64.rpm "https://download.splunk.com/products/splunk/releases/9.4.0/linux/splunk-9.4.0-6b4ebe426ca6.x86_64.rpm"
WGET Completed
We need to confirm now that the package has been downloaded successfully. Run the ls -l (or simply ll)command to see that the package is there.
Install Splunk by running the following command
rpm -ivh <YOURSPLUNKPACKAGE>
EXAMPLE: rpm -ivh splunk-9.4.0-6b4ebe426ca6.x86_64.rpm
Wait until download is complete.. It may take a few minutes.
You should see something like this
Updating / installing... 1:splunk-9.4.0-6b4ebe426ca6 ################################# [100%]complete
After the rpm command finishes. Splunk should now be installed on your ec2 server.
Let’s move to the installed location which should be /opt. Run this command to go to that location
cd /opt/
We are going to confirm that Splunk has been installed on our server.
Run the ls or ll command to list out the folders or files in this /opt directory
Now that we have confirmed that Splunk is installed locally on our server. We will check the status of Splunk.
For an absolute execution, run the following
/opt/splunk/bin/splunk status
Once you run the Splunk status command, you will be prompted with accept license since this is the first time you are installing Splunk. Press SPACE bar to read through the text until you get to the bottom.
You will see something like this:
Do you agree with this license? [y/n]:
Type y to agree with license
You will be prompted to create an administrator username and then add a password. ]You will also have to confirm the password
Password must contain at least: 8 total printable ASCII character(s).
We need to enable Splunk Web SSL or otherwise Splunk will not be accessible on the web.
Run the following command below to edit the Splunk Web file. We will use vim to edit the file. The vi command is for VIM a text editor in linux.
vi /opt/splunk/etc/system/local/web.conf
Press “i” to enter INSERT mode (You should see INSERT at the bottom)
Copy and paste the following inside of the file
[settings]
enableSplunkWebSSL = true
Press “ESC” (Then the INSERT at the bottom of your screen should disappear)
Press shift and : (colon)
Press wq! and press return/enter to exit and save VIM
Run the following to exit vi command
Web.conf example If you ran the absolute execution above, run the following to Start Splunk
/opt/splunk/bin/splunk start
IMPORTANT: Please Read and Validate the output as Splunk is starting. You should see the following if you have not customized anything.
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking kvstore port [8191]: open
Checking appserver port [127.0.0.1:8065]: open
You should see something like this if WebSSL is enabled correctly
Waiting for web server at https://127.0.0.1:8000 to be available
To confirm you are able to run splunk you would see something like this
The Splunk web interface is at https://ip-172-31-20-210.ec2.internal:8000
Splunk operates at 8000 port number so enter - https://<YOURPUBLICIPV4ADDRESS>:8000
EXAMPLE: https://54.86.34.135:8000
https://<YOURPUBLICIPV4DNS>:8000
EXAMPLE: https://ec2-54-86-34-135.compute-1.amazonaws.com:8000
Log in with username and password into Splunk
Happy Splunking
Comments