Setup splunk for virtual machine using Vagrant and Ansible

Splunk is a great tool for collecting and indexing data in any kind(log files, changes, tickets, scripts…) from any sources (sensors, networks, databases, smartphones,..(

Then creating index for data which then support us to analyse data or search data in the way we like it.

We want to try installing Splunk on Virtual environment in order to test, try, study… And with Vagrant&Ansible we can easily save our virtual machine configuration for next time use(in case my virtual machine was broken).

There is already Splunkbox by Phips on githubs for simply installing: https://github.com/phips/splunkbox

1.Download and install Virtual Box (You need a Virtual machine provider for Vagrant(Virtualbox is prefered))

https://www.virtualbox.org/wiki/Downloads

2. Download and install Vagrant

  http://www.vagrantup.com/downloads

3. Download and install Ansible

  http://docs.ansible.com/intro_installation.html

  For MAC: https://devopsu.com/guides/ansible-mac-osx.html

4. Clone splunk box

  https://github.com/phips/splunkbox

5. Download the centos virtual box

  http://vntx.cc/boxes/centos65.box

6. Add centos virtual box to vargant

$> vagrant box add c65 <your centos65.box path>

7. Setup splunk for virtual box(using vagrant and ansible)

Your centos c65 is already added to vagrant, but in order to setup splunk to that virtual machine, we need to prepare splunk’s setup files(Linux version) and some splunk’s applications.

7.1 Prepare splunk rpm

+ Download splunk for LINUX and put it in a <your splunkbox directory>/sw/ 

http://www.splunk.com/download

+ Check it's the same version as mentioned in <your splunkbox directory>/playbook.yaml and adjust the filename accordingly if it's not.

ex: splunkver: 6.1.1-207789-linux-2.6-x86_64 —> splunkver: <newest version’s name>

7.2 Download necessary apps for Splunk
Splunk lets you install useful apps for search, analyse... your data.

+ Take a look at <your splunkbox directory>/playbook.yaml, there is some applications required to be downloaded: 

+ Download SideView Utils: https://apps.splunk.com/app/466/

Put it in <your splunkbox directory>/sw/ 

+ Download SoS: https://apps.splunk.com/app/748/

Put it in <your splunkbox directory>/sw/ 

+ Download Splunk-6 dashboard: https://apps.splunk.com/app/1603/

Put it in <your splunkbox directory>/sw/ 

+ Download Splunk App for UNIX and Linux: https://apps.splunk.com/app/273/

7.2 Spunk setup

+ Navigate to splunkbox directory

+ Run command: $>vagrant up 

What Vagrant and ansible do is in 2 files: 

+ Vagrant runs following to the configuration ins <Your splunkbox folder>/VagrantFile. It setup vmbox environment and call ansible to run.

+ Ansible run following to the playbook.yaml, run the splunk setup. 

8. Run splunk

Open browser, type: localhost —> splunk will appear

If fail:

+ set ip address for the virtual computer

   +Navigate to folder: <your splunkbox folder>

   +Open Vagrantfile, edit like following:

# -*- mode: ruby -*-
# vi: set ft=ruby :

Vagrant.configure("2") do |config|
  config.vm.box = "c65"
  # config.vm.box_url = "http://vntx.cc/boxes/centos65.box"
  config.vm.network :private_network, ip: "192.168.50.2"
  config.vm.network :forwarded_port, guest: 80, host: 8080

  config.vm.provider :virtualbox do |vb|
    vb.gui = false
  end

  # provision with ansible
  config.vm.provision "ansible" do |ansible|
    ansible.playbook          = "playbook.yaml"
    ansible.sudo              = true
    ansible.host_key_checking = false
    # ansible.extra_vars        = { installapps: false }
  end
end


  +Save Vagrantfile

+ run command to stop/start vagrant: 

$> vagrant halt

$> vagrant up 

+ Open browser, type: 192.168.50.2 —> TADA!

NOTICE: You can browse your virtual computer by ssh

+ Navigate to <your splunkbox folder>

+ $>vagrant ssh

—> Your virtual machine appears
+ <your splunkbox folder> is also your share folder between your host machine and virtual machine