# Splunk forwarder

A Splunk forwarder is like a agent in Wazuh Siem. It is a piece of software the runs on a remote machine/client that sends data back to a central server



{% embed url="https://lantern.splunk.com/Splunk_Platform/Getting_Started/Getting_data_into_Enterprise?mt-learningpath=enterprisestart" %}

### Server Prep

1.  make sure the port you are using on the server to receive data is not blocked by firewall, typically it is

    1. open a firewall port in windows:&#x20;

    [https://ec.europa.eu/digital-building-blocks/sites/display/CEKB/How+to+open+a+port+on+the+firewall](https://ec.europa.eu/digital-building-blocks/sites/display/CEKB/How+to+open+a+port+on+the+firewall)
2. in splunk make sure you add a receiving port under settings > forward and receiving&#x20;
   1. click add new

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FtiRDpqMovjiHeuDhA6Io%2Fimage.png?alt=media&#x26;token=d9932b52-e1a9-47cd-973a-99250cf82e92" alt=""><figcaption></figcaption></figure>

3. add what ever port you want and click save, 9997 is the default

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FPz0bMBNmJBwXj6DZ3qJe%2Fimage.png?alt=media&#x26;token=8885c495-7ae8-4829-88c8-588bfb036014" alt=""><figcaption></figcaption></figure>

### Client Install&#x20;

1. Download the splunk forwarder. You need to have a splunk user and pass to proceed to the download link
   1.  make sure transfer or download to the client machine you want to run it



{% embed url="https://www.splunk.com/en_us/download/universal-forwarder.html?locale=en_us" %}

2. When starting the executable
   1. check the box to except the license
   2. &#x20;for this one we select on-prem
   3. click Customize Options

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FmkTlR9yIVOmBI5sk2P1q%2Fimage.png?alt=media&#x26;token=a73ea556-20d7-4cc3-b4d6-c581e5d6c700" alt=""><figcaption></figcaption></figure>

4. Unless you have a SSL Cert or know what it is, leave this blank&#x20;

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2F8tKwvYRcS2dCiSm6Ke1U%2F2.png?alt=media&#x26;token=a11f0ba2-1744-43ee-8e31-67d7db947217" alt=""><figcaption></figcaption></figure>

5. Select virtual account

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2F0cOOiFXOqa9eIVG1A6jt%2F3.png?alt=media&#x26;token=b4ae4e28-91f3-4fd7-a5eb-f165e728aa36" alt=""><figcaption></figcaption></figure>

6. Leave all this default

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FO4U4BAJjStRGhlBRacg4%2F4.png?alt=media&#x26;token=f1c709d1-3f6a-4df4-a89b-ca5b1dd9a6af" alt=""><figcaption></figcaption></figure>

7. Select the options you want to monitor&#x20;
   1. Performance monitors with run a lot and fill up your logs&#x20;

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FJHWIt4l8qiOF3kMBWqzS%2F5.png?alt=media&#x26;token=3f99a898-9294-4e7c-b6ff-44bec8d4cd9c" alt=""><figcaption></figcaption></figure>

8. add a user and password&#x20;
   1. usually you would use the same one for multiple endpoints&#x20;

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FsNjydLCnonvJx1C449Yf%2F6.png?alt=media&#x26;token=899e2963-348e-4bb2-85ba-9ad15f35c47c" alt=""><figcaption></figcaption></figure>

9. If you don't have a deployment server you can skip this&#x20;

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FcqTB0T3I8lSA6gqi7PH6%2F7.png?alt=media&#x26;token=91bd2669-5843-4c3d-aed8-e80a0442efe8" alt=""><figcaption></figcaption></figure>

10. this is your splunk server IP and listening port you set up in server &#x20;

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2F9YhTvb6GkzLMGIVprsmQ%2F8.png?alt=media&#x26;token=eb6176f2-9e58-466a-99f7-a79ffec2b04a" alt=""><figcaption></figcaption></figure>

11. install

### Troubleshooting

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FfMP5mPYlSHEA5i8XaXau%2Fimage.png?alt=media&#x26;token=970a94c7-7f2e-4cf6-a578-828f4a4174b0" alt=""><figcaption></figcaption></figure>

* if you see this just hit OK some times it works after that other times it will start to roll back. If it has rolled back restart the computer and try again.
* if successful you are good
