splunk-forwarder

Splunk@Splunk's Ansible role for installing Splunk, upgrading Splunk, and installing apps/addons on Splunk deployments (VM/bare metal)

Splunk topics with detailed explanation

This is an Ansible role and playbook for upgrading or installing a Splunk forwarder of the latest version.

Splunk forwarder installation

Cribl App to monitor Splunk Universal Forwarder traffic through Cribl Stream. Captures attributes such as Last Seen date/time, IP, Host, OS, Version, etc for each forwarder using using KV store to persist information. Option to exports forwarder list to CSV.

Used to migrate inputs.conf configurations from the Splunk Universal Forwarder to Cribl Edge Sources

Splunk log monitoring on AWS EC2 with Universal Forwarder and Indexer setup.

Analyze DNS logs using Splunk SIEM with Ubuntu Forwarder and Windows Splunk Enterprise