Windows Server Core is the perfect candidate for Splunk Enterprise Indexer used by the famous uberAgent. In this quick post I’m going to show you how to automatically download, install and configure Splunk for SSL Encryption.
Install.ps1
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
Write-Verbose "Setting Arguments" -Verbose $StartDTM = (Get-Date) $Vendor = "Splunk" $Product = "Enterprise Indexer" $Version = "7.0.0" $PackageName = "Splunk" $InstallerType = "msi" $Source = "$PackageName" + "." + "$InstallerType" $LogPS = "${env:SystemRoot}" + "\Temp\$Vendor $Product $Version PS Wrapper.log" $LogApp = "${env:SystemRoot}" + "\Temp\$PackageName.log" $Destination = "${env:ChocoRepository}" + "\$Vendor\$Product\$Version\$packageName.$installerType" $UnattendedArgs = "/i $PackageName.$InstallerType ALLUSERS=1 AGREETOLICENSE=YES /qn /liewa $LogApp" $url = "https://download.splunk.com/products/splunk/releases/7.0.0/windows/splunk-7.0.0-c8a78efdd40f-x64-release.msi" Start-Transcript $LogPS if( -Not (Test-Path -Path $Version ) ) { New-Item -ItemType directory -Path $Version } CD $Version Write-Verbose "Downloading $Vendor $Product $Version" -Verbose If (!(Test-Path -Path $Source)) { Invoke-WebRequest -Uri $url -OutFile $Source } Else { Write-Verbose "File exists. Skipping Download." -Verbose } Write-Verbose "Starting Installation of $Vendor $Product $Version" -Verbose (Start-Process msiexec.exe -ArgumentList $UnattendedArgs -Wait -Passthru).ExitCode Write-Verbose "Customization" -Verbose copy-item -Path "\\dc-01.xenapptraining.com\xa\Certificates\wildcard.pem" -Destination "C:\Program Files\Splunk\etc\auth" -Recurse -Force copy-item -Path "\\dc-01.xenapptraining.com\xa\Certificates\wildcard.key" -Destination "C:\Program Files\Splunk\etc\auth" -Recurse -Force $File = "C:\Program Files\Splunk\etc\system\local\web.conf" New-Item $File -type file Add-Content $File "[settings]" Add-Content $File "enableSplunkWebSSL = true" Add-Content $File "httpport = 8443" Add-Content $File "privKeyPath = C:\Program Files\Splunk\etc\auth\wildcard.key" Add-Content $File "serverCert = C:\Program Files\Splunk\etc\auth\wildcard.pem" Write-Verbose "Stop logging" -Verbose $EndDTM = (Get-Date) Write-Verbose "Elapsed Time: $(($EndDTM-$StartDTM).TotalSeconds) Seconds" -Verbose Write-Verbose "Elapsed Time: $(($EndDTM-$StartDTM).TotalMinutes) Minutes" -Verbose Stop-Transcript |
Configure.ps1
The following script will automatically configure Splunk with the uberAgent App.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
Write-Verbose "Setting Arguments" -Verbose $StartDTM = (Get-Date) $Vendor = "Misc" $Product = "uberAgent x64" $PackageName = "uberAgent-64" $InstallerType = "msi" $Version = "4.2" $LogPS = "C:\Windows\Temp\$Vendor $Product $Version PS Wrapper.log" $LogApp = "C:\Windows\Temp\$PackageName.log" $Destination = "${env:ChocoRepository}" + "\$Vendor\$Product\$Version\$packageName.$installerType" $UnattendedArgs = "/i $PackageName.$InstallerType ALLUSERS=1 SERVERS=MGMT-01:19500 /qn /liewa $LogApp" Start-Transcript $LogPS Write-Verbose "Starting Installation of $Vendor $Product $Version" -Verbose Write-Verbose "Customization" -Verbose CD "$Version\uberAgent components\uberAgent_indexer" copy-item -Path . -Destination "C:\Program Files\Splunk\etc\apps\uberAgent_indexer" -Recurse -Force CD.. CD "uberAgent_searchhead" copy-item -Path . -Destination "C:\Program Files\Splunk\etc\apps\uberAgent" -Recurse -Force Write-Verbose "Stop logging" -Verbose $EndDTM = (Get-Date) Write-Verbose "Elapsed Time: $(($EndDTM-$StartDTM).TotalSeconds) Seconds" -Verbose Write-Verbose "Elapsed Time: $(($EndDTM-$StartDTM).TotalMinutes) Minutes" -Verbose Stop-Transcript |
Make sure that your key file isn’t encrypted with a password. I was messing around a full day trying to figure out my certificates, because Splunk logs doesn’t provide to much info when something goes wrong. For example [settings] in the web.conf are case sensitive.
Using Digicert Certificate Utility solved this in no time, just rename crt to pem.
