How to Download and Install a Splunk Forwarder

The security of your Splunk platform deployment is of utmost importance. To ensure the integrity of your data and prevent unauthorized access, Python modules on Splunk platform instances always validate TLS connections. This means that Splunk platform instances verify the hostname in the TLS certificate they receive when connecting to other Splunk platform instances.

To understand the changes made to improve security functionality, it's essential to know the different operational modes in which these changes come. There are two primary modes: upgrades to Splunk deployment client and server authentication logic, including restrictions on how and with what those instance types can communicate; and improvements to universal forwarder security, including limiting access to the UF management port to only the local machine.

One of the key improvements is the addition of Transport Layer Security (TLS) certificate host name validation. This ensures that when Splunk platform instances make secure connections, they validate the hostname in the TLS certificate received from other instances.

Another significant improvement is the support for TLS certificate validation by the Splunk daemon (splunkd), all Python modules used by the Splunk platform, the Splunk CLI, and App Key Value Store. This means that all these components now have the ability to verify the authenticity of certificates before establishing connections.

The latest versions of Splunk Enterprise and Splunk Cloud Platform offer additional options for securing deployments. With version 9.1, you can take advantage of these improvements, which were also included in version 9.0. If you upgrade from a lower version (less than 9.0), the new security functionality will be available.

To download and install a Splunk forwarder, follow these steps:

1. Go to the 'splunk forwarder download' page on the official Splunk website.

2. Select the appropriate version of the forwarder for your deployment type (Splunk Enterprise or Splunk Cloud Platform).

3. Choose the operating system and architecture that match your environment.

4. Click the 'Download' button to initiate the download process.

5. Follow the installation instructions provided by Splunk to install the forwarder on your instance.

By following these steps, you can ensure a secure connection between your Splunk platform instances and take advantage of the improved security functionality in the latest versions of Splunk Enterprise and Splunk Cloud Platform.

Splunk forwarder download