# Splunk Installation

Before we install splunk we need to change some settings.

First we remove the "virbr0" network interface as it's useless for our project. Virbr0 is used for virtualization purposes and acts as a switch you can connect your guests and your host if you are virtualizing.[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/qAuimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/qAuimage.png)

To do this enter following commands:

`<span class="monospace">systemctl stop libvirtd.service</span>`

`<span class="monospace">systemctl status libvirtd.service -> make sure service is innactive</span>`

`<span class="monospace">systemctl disable libvirtd.service</span>`

`<span class="monospace">reboot</span>`

<span class="monospace">After reboot the interface is removed.</span>[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/Svcimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/Svcimage.png)

### Install Splunk

Now we are one step closer to the Splunk CTF. First we need to install Splunk Enterprise.

Splunk Enterprise is free for 60 days and afterwards you'll need to provide a license anyway we download Splunk enterprise from the homepage <span class="wikiexternallink">[https://www.splunk.com/de\_de/download/splunk-enterprise.html](https://www.splunk.com/de_de/download/splunk-enterprise.html)</span>  
Probably you need to log in yourself to have access. [![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/E1Eimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/E1Eimage.png)

I followed the guide of Splunk <span class="wikiexternallink">[https://docs.splunk.com/Documentation/Splunk/7.0.3/Installation/InstallonLinux](https://docs.splunk.com/Documentation/Splunk/7.0.3/Installation/InstallonLinux)</span>

We are downloading the RPM package. Once downloaded we can start with the installation.

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/obhimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/obhimage.png)

Confirm that the RPM package you want is available locally on the target host.

Verify that the Splunk Enterprise user account that will run the Splunk services can read and access the file.

If needed, change permissions on the file.

`<span class="monospace">chmod 744 splunk_splunk-8.2.2.1-ae6821b7c64b-linux-2.6-x86_64.rpm</span>`

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/cEjimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/cEjimage.png)

Invoke the following command to install the Splunk Enterprise RPM in the default directory /opt/splunk.

`<span class="monospace">rpm -i splunk-8.2.2.1-ae6821b7c64b-linux-2.6-x86_64.rpm</span>`

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/dDXimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/dDXimage.png)

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/G00image.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/G00image.png)

Now as Splunk is installed we need to set the admin password.

Go to the directory: /opt/splunk/bin  
[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/LLTimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/LLTimage.png)

Afterwards you are prompted to accept the license. Accept it and go on.

Choose and administrator username:[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/5b8image.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/5b8image.png)

Provide a password and splunk will get started.[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/i1wimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/i1wimage.png)

By checking on the browser in the CentOS VM localhost:8000 we should see a Splunk login screen:[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/pfKimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/pfKimage.png)