How can I install Splunk universal forwarder on Linux?

Body

This document outlines a set of instructions that were performed on a Red Hat Linux system. These instructions are applicable to any system that uses the RPM style package management system.
 
The Linux Install should be performed as root. Download installation files from: https://uofi.box.com/v/splunk
 
Splunk Doc:
https://help.splunk.com/en/splunk-enterprise/forward-and-process-data/universal-forwarder-manual/9.4/install-the-universal-forwarder/install-a-nix-universal-forwarder

 

Install the Splunk Universal Forwarder and start the process

  •  Install in the default directory opt/splunkforwarder: 
rpm -i /tmp/splunkforwarder-9.2.1-78803f08aabb.x86_64.rpm
  • Start splunk the first time:
/opt/splunkforwarder/bin/splunk start --accept-license
Output:
 

 

Enable the Universal Forwarder to start on boot

/opt/splunkforwarder/bin/splunk enable boot-start -systemd-managed 0

 

Configuring the Deployment Server:

Try one of the following:

  • Use the CLI

/opt/splunkforwarder/bin/splunk set deploy-poll deployment.splunk.uic.edu:8089

  • Edit deploymentclient.conf​​​​​​​

            You can also directly create and edit a deploymentclient.conf file in $SPLUNK_HOME/etc/system/local.

cd /opt/splunkforwarder/etc/system/local 

vi deploymentclient.conf 

[deployment-client]
 
[target-broker:deploymentServer]
targetUri = deployment.splunk.uic.edu:8089

### make sure change the owner of deploymentclient.conf to splunkfwd
​​​​​​​
chown splunkfwd:splunkfwd deploymentclient.conf

Restart the Universal Forwarder & it should begin connecting to the deployment server shortly after the restart is complete

/opt/splunkforwarder/bin/splunk restart

Verify service is running as splunk user:

ps -ef | grep splunk

Configure Firewall Rules

Make sure firewall allows traffic to 8089/tcp on splunk-deployment.server.uic.edu (131.193.68.94) and inputs1.illinoischicago.splunkcloud.com:9997, .. inputs15.illinoischicago.splunkcloud.com:9997

Details

Details

Article ID: 879
Created
Fri 1/15/21 7:12 PM
Modified
Tue 7/29/25 10:57 AM

Related Services / Offerings

Related Services / Offerings (1)

Event Logging
A software platform used to search, analyze and visualize any type of machine-generated data gathered for data processing to create reports, dashboards and alerts.