Splunk Basics Course

In this lecture, we will download and install VMware Player as it will host all our virtual machines and virtual appliance in this course. 

In this lecture, we will deploy the Ubuntu Linux operating system for Splunk server and Apache server.

Also, we will login for the first time to the newly deployed machines, default password for osboxes user is osboxes.org

In this lecture, we will assign static IPs for our machines and we will change the default password for osboxes user.

In this lecture, we will download Splunk packages for Splunk main server and Splunk universal forwarder that will collect logs from the Apache server and forward it to Splunk main server.

Also, we will install the Apache webserver to have it ready for the next lectures.

In this lecture, we will import Fortigate virtual appliance into VMware Player, and set a static IP and default gateway for the virtual appliance.

In this lecture, we will install Splunk Enterprise software on Splunk server machine, and install Splunk Universal Forwarder on the Apache server machine.

Note:

When the course was recorded Splunk version was 8.0.4.1, On 10-09-2022 I validated Splunk Enterprise 9.0.1 on my own test lab and the steps and instructions in this course still apply.

In this lecture, we will talk about different deployment types of Splunk.

In this lecture, we will upload a sample log file to Splunk and explore  this data from Splunk web interface.

Also, we will configure required network ports on Splunk server to receive data from Syslog feed (Fortigate appliance) and from Apache server (using Splunk Universal Forwarder).

In this lecture, we will collect logs from the Apache web server and send it to Splunk server.

In this lecture, we will login to the web interface of Fortigate firewall to configure it to send its logs to Splunk server.

In this lecture, we will login to Splunk server web interface to explore the data we on sent to Splunk in previous lectures.

In this lecture, we will extract the fields of Apache access logs using:

1. Splunk Interactive Field Extractor (IFX)

2. Regular expressions

In this lecture, we will have a quick introduction to Splunk SPL "Search Processing language" with some examples.

In this lecture, we will create reports based on the data we received from Fortigate firewall and Apache web server, then we will place these reports into two different dashboards:

1. Firewall stats

2. Apache stats

In this lecture, we will learn about one of the most important features of Splunk which is the Alerting but unfortunately, it is not available in the free license of Splunk, but we can use it in the trial version for 60 days.

We will configure our alert to be sent to "Triggered Alerts" page and also to be sent to an email.