How to install splunk universal forwarder

Hello Readers! In this blog we will see how to install splunk universal forwarder. But first let us know what splunk universal forwarder is? In short, we call splunk universal forwarder, as splunk uf. It is a separate software package and is free to download where a license is not required.

Steps to install:

1. First we have to download the software. Open your web browser and search for it. Click the link to download https://www.splunk.com/en_us/download/universal-forwarder.html It will redirect us to the splunk, click on free Splunk.

Either you have to sign in or if you don’t have an account, then you have to create an account then sign in.

2. Once you come to this page, click on Linux, then click on .deb file which is for Ubuntu.Click on download now.

3.Now you have two options. One is just downloading the file and the other option is under the useful tools you have the option to use the wget link.

4.Now open your terminal and if you do not have wget installed, you can run the command below.

        sudo apt install wget -y

5. Copy and paste the wget link from the browser. You can see the file is downloading.

wget -O splunkforwarder-8.2.5-77015bc7a462-linux-2.6-amd64.deb 'https://download.splunk.com/products/universalforwarder/releases/8.2.5/linux/splunkforwarder-8.2.5-77015bc7a462-linux-2.6-amd64.deb'

6. If we run the ls command, then we see the latest version i.e 8.2.4.

ls 

7. Now we run the command sudo su for switching to the root user.

sudo su

8. If we run the dpkg -i command then we just type the first couple letter then push tab to complete and press enter.

dpkg -i splunkforwarder-8.2.5-77015bc7a462-linux-2.6-amd64.deb

9. Now we can check the opt directory and run ls and you can see that it is installed. Also, we have bin folder.

cd /opt/splunkforwarder/
ls
cd bin

10. We will do the same process that we use to start splunk enterprise. we run the below command to start splunk forwarder.

./splunk start

It will ask to agree with the license and will ask for user name and password. you will see splunk universal forwarder installed and running successfully.

Conclusion:

We install splunk universal forwarder on servers or endpoints from where we want to collect events. UF can be managed by deployment server and it cannot parse events.