I had to shut off my Winodws Firewall and also the Firewall on Avast Anti-Virus to allow access from my desktop to VM's.
My Splunk Lab
Download and install Free VMware player onto your Windows system for setting up a Windows Server 2022 version that will be the remote server sending event logs to the Splunkd server.
Register and download Splunkd enterprise and seems to run fine without any licesne. The Splunk Enterprise edition is free for 60 days. I installed this on my WIndows 10 system.
Download and install the universal forwarder to be used to install on the server in VMware player. This will send data to your Splunkd server on your workstation. Free to register for downloads and no credit card required.
I was able to go online, download and install this without any issues. So happy that MS allows us to go online and spin this up for learning.
VMware Player
When setting up the VM I created the VM first and did not install the operating system. Once that is complete go to the manage settings and mount the ISO and start the VM. If you don't do this, you usually get a error about not being able to accept the end user license agreement.
When setting up the VM I changed the network settings to bridged so the VM could get DHCP from my local cable router / modem. Now I can ping, share files, and get logs from the VM since they are on the same network.
Windows Server 2022
​
When setting up the operating system I changed the IP, Subnet, DNS and gateway to static.
​
I also turned off the Windows firewall just to be sure that would not cause and issues.
Splunkd Enterprise
​
I shut off the Windows Firewall on the local workstation I was installing Splunkd onto. I also have a static IP on the workstation.
When Splunkd is running I was able to access it on 127.0.0.1 as well as the local 192.168.x.x IP address on port 8000.
On the Splunkd the only thing I really had to do to allow inbound data was to configure receiving.
Splunkd Universal Forwarder
for Windows
​
When installing this application, I did have issues because I was not aware I needed to click the customize setup button to allow me to select check boxes for the Event Viewer. Once I learned that step all my data began to show up in Splunkd.
