日志监控利器-splunk安装（一）

一.
环境：Centos 6.5 64 bit
下载：download.splunk.com
选择：
注意:下载安装包前需要注册。

二.
安装

tar -zxvf splunk-6.2.1-245427-Linux-x86_64.gz
cd ..
mv splunk /usr/local
[root@centos bin]# ./splunk enable boot-start
Init script installed at /etc/init.d/splunk.
Init script is not configured to run at boot.
#splunk新特点，使用enable boot-start加入/etc/init.d/splunk，相比以前方便了不少。
#关于./splunkd enable boot-start
#大家可以使用：./splunk help boot-start,查看官方该解释。
检查是否自启动：
[root@centos bin]# chkconfig --list splunk
splunk             0:关闭    1:关闭    2:启用    3:启用    4:启用    5:启用    6:关闭
启动splunk
[root@centos bin]# /etc/init.d/splunk start
Starting Splunk...

Splunk> Finding your faults, just like mom.

Checking prerequisites...
    Checking http port [8000]: open
    Checking mgmt port [8089]: open
    Checking appserver port [127.0.0.1:8065]: open
    Checking kvstore port [8191]: open
    Checking configuration...  Done.
        Creating: /usr/local/splunk/var/run/splunk
        Creating: /usr/local/splunk/var/run/splunk/appserver/i18n
        Creating: /usr/local/splunk/var/run/splunk/appserver/modules/static/css
        Creating: /usr/local/splunk/var/run/splunk/upload
        Creating: /usr/local/splunk/var/spool/splunk
        Creating: /usr/local/splunk/var/spool/dirmoncache
        Creating: /usr/local/splunk/var/lib/splunk/authDb
        Creating: /usr/local/splunk/var/lib/splunk/hashDb
    Checking critical directories...    Done
    Checking indexes...
        Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary
    Done
New certs have been generated in '/usr/local/splunk/etc/auth'.
    Checking filesystem compatibility...  Done
    Checking conf files for problems...
    Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...  
Generating a 1024 bit RSA private key
......................++++++
...++++++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=centos/O=SplunkUser
Getting CA Private Key
writing RSA key
Done
                                                           [确定]

Waiting for web server at  to be available.... Done


If you get stuck, we're here to help.  
Look for answers here: 

The Splunk web interface is at

安装完成！
访问地址：127.0.0.1：8000
注意：第一次安装默认用户名和密码是：admin/changeme
需要自己重新设置密码。