topic Re: Stream Forwarder never come online in Splunk Enterprise

Stream Forwarder never come online

Footoasis0868 — Wed, 07 Aug 2024 04:03:12 GMT

Hi All,

Deployment: Single Instance Splunk Enterprise

What I want: install the Splunk_TA_stream on my universal forwarder to capture DNS traffic as stream

The doc I followed

The App and add-on are already installed

The Splunk_TA_stream has been deployed to the UF:

But I found that the streamfwd.exe is not running. Also I don't see the UF in the dashboard:

(only the splunk single instance itself is present, and it is even in Error Status)

Any insights for me to discover what went wrong?

Thank you in advance.

Re: Stream Forwarder never come online

scelikok — Wed, 07 Aug 2024 05:51:03 GMT

Hi @Footoasis0868,

Can you confirm if your Splunk instance GUI access is HTTPS enabled? If not your splunk_stream_app_location setting on UF must be http://xxxxx:8000/en-us/custom/splunk_app_stream/

Regarding your Splunk instance itself error state, please confirm you run set_permissions.sh to be able to start streamfwd.exe

Re: Stream Forwarder never come online

Footoasis0868 — Thu, 08 Aug 2024 01:57:48 GMT

Hi @scelikok ,

Thanks. I checked the URL, and it is an error page and I can't locate the requestid from the splunk internal logs.

Regarding the set_permissions.sh, yes, I have run it using root in my Splunk instance. Just make it clear, I don't need to run similar script on the Windows server where I deployed the Splunk_TA_Stream app, correct?

Thanks again.

Re: Stream Forwarder never come online

Footoasis0868 — Thu, 15 Aug 2024 06:20:22 GMT

Anyone who have idea on this??

Thanks in advance.