topic Re: raspberry installation in Splunk Enterprise

raspberry pi installation- Why am I receiving this error?

lironalter — Fri, 03 Jun 2022 21:52:42 GMT

trying to forward logs from node process that runs on a raspberry pi model 3b

the error i get when i try ti run the splunk universal forwarder on my pi

running the file command on the splunk executable returns this result:

of course i downloaded the arm version of the universal forwarder.

any help will be much appreciated

rpi specs:

os details:

Re: raspberry installation

codebuilder — Tue, 06 Jul 2021 15:21:34 GMT

First thing I notice is that you aren't passing in any arguments. Simply running the splunk binary won't have any effect. If you're trying to start it up for the first time try using:

$SPLUNK_HOME/bin/splunk start

Re: raspberry installation

lironalter — Wed, 07 Jul 2021 06:37:57 GMT

Thanks for answering!

Obviously it returns the same error since the error is that the file can't even be execute...

Here is an example:

Re: raspberry installation

codebuilder — Wed, 07 Jul 2021 14:49:23 GMT

Try adding execute permissions to the binary:

chmod +x $SPLUNK_HOME/bin/splunk

Also, who owns it? If it's owned by root be sure you are using sudo or log in as the root user.

sudo $SPLUNK_HOME/bin/splunk start

Re: raspberry installation

lironalter — Thu, 08 Jul 2021 07:51:02 GMT

Really appreciate your helping!

As I said before as I suspect the issue here is that the OS cannot execute the file at all.

Tried you suggestion and got the same error, the file permissions are:

-r-xr-xr-x

so no issue there.

Any other ideas? thanks again!

Re: raspberry installation

codebuilder — Thu, 08 Jul 2021 14:12:34 GMT

Who owns the binary? It looks like you have it installed at /home/pi so you'll need to either run it as root or as the "pi" user. Any user other than root or "pi" won't be able to execute it.

Re: raspberry installation

codebuilder — Thu, 08 Jul 2021 14:24:10 GMT

You might also check the reply by @hsesterhenn_spl on this topic:

https://community.splunk.com/t5/Splunk-Enterprise/Splunk-on-ARM-Achitecture/m-p/512005

Re: raspberry installation

__Sebastian — Fri, 03 Jun 2022 14:46:55 GMT

which OS you are using to install the UF?

Re: raspberry pi installation- Why am I receiving this error?

EnricoP — Fri, 28 Jul 2023 08:27:37 GMT

You are probably using a 32bit raspberry pi os and trying to run the 64bit UF

last ARMv6 is 8.1.9 universal forwarder