Splunk安装和配置

安装环境:
CentOS 6.2 64Bit

安装：
   首先关闭selinux：

#vi /etc/sysconfig/selinux 
SELINUX=disabled 
setenforce 0

下载最新版:
splunk-6.0.1-189883-Linux-x86_64.tgz 
#tar -zxvf splunk-6.0.1-189883-Linux-x86_64.tgz 
#cd .. 
#mv splunk /usr/local 
#cd /usr/local/splunk/bin 
#./splunk enable boot-start

然后需要浏览完协议后输入"y"

第一次安装会提示：

This appears to be your first time running this version of Splunk.
Copying '/usr/local/splunk/etc/openldap/ldap.conf.default' to '/usr/local/splunk/etc/openldap/ldap.conf'

Moving '/usr/local/splunk/share/splunk/search_mrsparkle/modules.new' to '/usr/local/splunk/share/splunk/search_mrsparkle/modules'.
Init script installed at /etc/init.d/splunk.
Init script is not configured to run at boot.

把/usr/local/splunk/etc/openldap/ldap.conf.default拷到/usr/local/splunk/etc/openldap/ldap.conf
然后执行:

#/etc/init.d/splunk start
Starting Splunk...

Splunk> Take the sh out of IT.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking configuration...  Done.
                Creating: /usr/local/splunk/var/lib/splunk
                Creating: /usr/local/splunk/var/run/splunk
                Creating: /usr/local/splunk/var/run/splunk/appserver/i18n
                Creating: /usr/local/splunk/var/run/splunk/appserver/modules/static/css
                Creating: /usr/local/splunk/var/run/splunk/upload
                Creating: /usr/local/splunk/var/spool/splunk
                Creating: /usr/local/splunk/var/spool/dirmoncache
                Creating: /usr/local/splunk/var/lib/splunk/authDb
                Creating: /usr/local/splunk/var/lib/splunk/hashDb
        Checking critical directories...        Done
        Checking indexes...
                Validated: _audit _blocksignature _internal _thefishbucket history main summary
        Done
New certs have been generated in '/usr/local/splunk/etc/auth'.
        Checking filesystem compatibility...  Done
        Checking conf files for typos...        Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done
                                                           [确定]
Starting splunkweb...  Generating certs for splunkweb server
Generating a 1024 bit RSA private key
.............++++++
.....................................................++++++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=localhost.localdomain/O=SplunkUser
Getting CA Private Key
writing RSA key
                                                           [确定]
Done

If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://127.0.0.1:8000

最后在浏览器里输入:

http://localhost:8000/

如果无法访问，先看看是不是防火墙开了，如果开了请添加8000端口或者临时关闭；
#service iptables stop