Setting up Splunk forwarders

In this section, we will set up the Splunk forwarders. Remember that the forwarders will collect Windows event logs and send them on to the indexer. First, let’s use the following steps to install and configure Splunk on the three Windows-based AWS instances to host our forwarders:

1. Before we can access the Windows-based instances, we will need to generate a password.
2. Click on the forwarder1 Windows-based AWS instance in your AWS console.
3. Click on the white Connect button at the top of the page. The Connect to instance page tells us how to access the instance.
4. Navigate over to the RDP client tab. Download the remote desktop file to set up your RDP session. You will need the public DNS or IPv4 address, the Administrator username, and the password.
5. Click on Get password (see Figure 2.14) to retrieve the password. Click the yellow Decrypt password button:

Figure 2.14 – Get password screen...