1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Configure Receiving Port in Splunk SIEM Console
Open network input channels inside the SIEM configuration templates to receive remote logs.
- Deploy Splunk Enterprise on your SIEM server and open `http://localhost:8000` in the browser.
- Log in with admin credentials. From the top bar, click Settings -> Forwarding and receiving.
- Under the Configure receiving section, click Add new.
- In the **Port** field, enter:
9997.
- Click Save. Splunk is now listening for incoming forwarder log traffic.
STEP 2
Install and Configure Universal Forwarder Agent on Guest Nodes
Install agent daemons on target servers and configure them to forward local logs.
- Log in to your Kali Linux VM. Download and install the Splunk forwarder package.
- Open your terminal and run the commands below:
$ sudo dpkg -i splunkforwarder-*.deb
This installs the Splunk Universal Forwarder software package locally.
$ sudo /opt/splunkforwarder/bin/splunk add forward-server 192.168.56.100:9997 -auth admin:changeme
This tells the forwarder to route its local traffic to the SIEM indexer at IP 192.168.56.100 on port 9997.
$ sudo /opt/splunkforwarder/bin/splunk add monitor /var/log/auth.log -index security
This configures the forwarder to monitor the local authentication log file and tag it with the security index prefix.
4. Part 2: Complete Deliverable Assets & Production Templates
To verify the forwarder connectivity status, save the script below as verify_forwarder.sh and execute it:
$ chmod +x verify_forwarder.sh && ./verify_forwarder.sh
This configures execution flags and runs the Splunk forwarder state inspector.
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
#!/usr/bin/env bash
Line 2: This is a comment that describes what the code does: "!/usr/bin/env bash". Comments start with # and are ignored by Python.
# verify_forwarder.sh - Splunk Forwarder Health Checker
Line 3: This is a comment that describes what the code does: "verify_forwarder.sh - Splunk Forwarder Health Checker". Comments start with # and are ignored by Python.
set -euo pipefail
Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "[*] Checking Splunk Forwarder Service status..."
Line 5: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
if /opt/splunkforwarder/bin/splunk status | grep -q "splunkd is running"; then
Line 6: A conditional check — the code inside this block only runs if the condition evaluates to True.
echo "[OK] Forwarder daemon active."
Line 7: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
/opt/splunkforwarder/bin/splunk list forward-server
Line 8: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
else
Line 9: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "[FAIL] Splunk Forwarder service not running."
Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
exit 1
Line 11: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
fi
Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
#!/usr/bin/env bash
# verify_forwarder.sh - Splunk Forwarder Health Checker
set -euo pipefail
echo "[*] Checking Splunk Forwarder Service status..."
if /opt/splunkforwarder/bin/splunk status | grep -q "splunkd is running"; then
echo "[OK] Forwarder daemon active."
/opt/splunkforwarder/bin/splunk list forward-server
else
echo "[FAIL] Splunk Forwarder service not running."
exit 1
fi
5. Deliverables Summary
Created Files / Templates
- Splunk forwarder inputs configuration file:
/opt/splunkforwarder/etc/apps/search/local/inputs.conf
verify_forwarder.sh - Status checking script
Verification Artifacts
- Screenshots showing active search results on Splunk console using search query:
index=security.
- Output log of
verify_forwarder.sh showing successful connection state.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
