Summary

In this chapter, we deployed a simple Splunk environment. The environment included a search head, indexer, deployment server, and three forwarders. We used a combination of the CLI, configuration file changes, and Splunk Web to configure each of these components. Our three Windows-based forwarders are managed by the deployment server. We then used the deployment server to install add-ons to different Splunk instances. The forwarders are configured to send data to the indexer and the search head is configured to send search requests to the indexer. Finally, we discussed the different concepts in Splunk access management including capabilities, roles, users, and authentication schemes. Splunk provides us with pre-defined roles that come with a set of capabilities. A Splunk administrator can create new roles that inherit from these existing roles and assign the roles to users. In addition, we can choose to use authentication schemes such as LDAP and SAML instead of the basic Splunk...