How to install Splunk on Ubuntu 18.04 server

Step 1: Download Splunk

1. Download the .tar.gz Package: Go to the Splunk website and find the download page for Splunk Enterprise. Look for the .tar.gz package suitable for Linux. You can use wget to download it directly to your server:

    wget -O splunk-8.2.3-887a25f85366-linux-2.6-amd64.tgz 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.2.3&product=splunk&filename=splunk-8.2.3-887a25f85366-linux-2.6-amd64.tgz&wget=true'
   

2. Step 2: Extract and Install Splunk:Once downloaded, extract the .tar.gz file to a directory of your choice. Typically, you would extract it to /opt directory:

sudo tar -zxvf splunk-8.2.3-887a25f85366-linux-2.6-amd64.tgz -C /opt

Step 3: Start Splunk:

cd /opt/splunk/bin
sudo ./splunk start --accept-license

Step 4: Access Splunk Web Interface

4. Access Splunk Web: Once Splunk has started successfully, you can access the Splunk web interface by opening a web browser and navigating to http://<your-server-ip>:8000.

Step 6: Optional - Enable Start on Boot

6. Enable Start on Boot (Optional): To ensure Splunk starts automatically when the server boots up, use the following command:

sudo /opt/splunk/bin/splunk enable boot-start

Step 7: Verification

7. Verify Splunk Status: Check the status of Splunk to ensure it is running:

sudo /opt/splunk/bin/splunk status