My Environment

• Raspberry Pi 3 running:

  Linux raspberrypi 5.4.83-v7+ #1379 SMP Mon Dec 14 13:08:57 GMT 2020 armv7l GNU/Linux

• Pi-hole v5.2.4
• Web Interface v5.4
• FTL v5.7
• Splunk running in a Docker container on a Synology NAS

Preparation

You will need:

• A free Splunk account to get the latest version of the Splunk Universal Forwarder.
• Pi-Hole up and running.
• Root access to your Pi-Hole server.

Installation

1. Sign up for a Splunk account at Splunk.com.
2. Navigate to the download page for the Splunk Universal Forwarder and get the wget command line for the ARM package and download. NOTE: The latest ARM package available for me was 8.2.1. This was not working for me because the I was running 32 bit Raspbian so I had to go to the previous package repository and get the 8.2.1 ARM package. See here. You can check if your Splunk UF is 32bit or 64bit by running this command once you have extracted the package (see next step):

   file /opt/bin/splunkforwarder/splunk

3. Extract the package to /opt
4. Create a new user called ‘splunk’ to run Splunk UF.
5. Change ownership of the splunk directory to splunk, and set variable:

   export SPLUNK_HOME=/opt/splunk
   chown -RP splunk:splunk /opt/splunkforwarder

6. Create a new file: /opt/splunkforwarder/etc/system/local/inputs.conf with the following:

   # inputs.conf
   [monitor:///var/log/pihole.log]
   disabled = 0
   sourcetype = pihole
   index = pihole
   
   [monitor:///var/log/pihole-FTL.log]
   disabled = 0
   sourcetype = pihole:ftl
   index = pihole

7. Create a new file: /opt/splunkforwarder/etc/system/local/outputs.conf with the following:

   [tcpout]
   defaultGroup=indexer
   
   [tcpout:indexer]
   server=192.168.1.50:9997

   NOTE: set the server to your Splunk indexer or Splunk Heavy Forwarder IP address.

8. Set Splunk Universal Forwarder to start at boot time:

   [sudo] $SPLUNK_HOME/bin/splunkforwarder enable boot-start

9. Reboot Splunk Universal Forwarder or just reboot the entire Raspberry Pi.
10. Switch over to the splunk user.
11. Start splunk:

    /opt/splunk/bin/splunkforwarder start --accept-license -user splunk

Pi-Hole Configuration

1. Create a new file: /etc/dnsmasq.d/02-pihole-splunk.conf with:

   log-queries=extra

2. Restart Pihole or restart the Raspberry Pi.

Splunk configuration

1. Download and install the Pihole TA. This will provide field extraction for the Pihole logs.
2. If you want the prebuilt dashboards, download the Pihole App.