topic Re: Splunk Cloud Forwarder on Linux in Deployment Architecture

Splunk Cloud Forwarder on Linux

kleanthis — Mon, 26 Feb 2018 08:23:19 GMT

Hello,

I am following the guide here : https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/User/ForwardDataToSplunkCloudFromLinux

At some point it sais i need to install splunkclouduf.spl file which i have downloaded from my cloud instance using : splunk install app <full path to splunkclouduf.spl> -auth <username>:<password> . Problem is whenever i try to run that command i get : Not Found . I am 100% sure the path and credentials are correct . What am i missing ? Or is this a step i need or shall i skip it ?

Re: Splunk Cloud Forwarder on Linux

FrankVl — Mon, 26 Feb 2018 12:54:40 GMT

Are you sure you're in the right directory (bin folder inside your splunk universal forwarder installation folder)? Have your tried ./splunk... instead of just splunk...

Re: Splunk Cloud Forwarder on Linux

kleanthis — Mon, 26 Feb 2018 12:56:49 GMT

Yes and Yes.

root@host:/home/devuser/splunkforwarder/bin# ./splunk install app ../../splunkclouduf.spl -auth admin:changeme
Not Found

Re: Splunk Cloud Forwarder on Linux

kleanthis — Mon, 26 Feb 2018 12:57:48 GMT

Yes and Yes.

root@host:/home/devuser/splunkforwarder/bin# ./splunk install app ../../splunkclouduf.spl -auth admin:changeme
Not Found

Re: Splunk Cloud Forwarder on Linux

FrankVl — Mon, 26 Feb 2018 13:03:57 GMT

Does the user you run splunk as (non-root I hope) have permissions to access the .spl file?

Do other splunk commands work (e.g. ./splunk status)?

Re: Splunk Cloud Forwarder on Linux

kleanthis — Mon, 26 Feb 2018 13:10:13 GMT

root@host:/home/devuser/splunkforwarder/bin# ./splunk status
splunkd is not running.

I think i got it. I must have messed up something and splunk did not start . I will start from scratch and see what happens . Thanx.

Re: Splunk Cloud Forwarder on Linux

FrankVl — Mon, 26 Feb 2018 13:13:02 GMT

Ok, so the basic thing works, it's specifically that install command that fails. Not sure if splunk needs to be running to perform ./splunk install...