topic Re: deploying stream forwarder to universal forwarders does not work in Splunk Dev

deploying stream forwarder to universal forwarders does not work

sh_tavousi — Sun, 07 Mar 2021 12:47:40 GMT

Hi,

I'm having issue to deploy stream forwarder to UFs by Deployment Server. I have installed stream TA in deployment app but it doesn't work and I can't see forwarders in stream forwarder. In inputs.conf I set splunk_stream_app_location with address of my stream app and also I have stream logs from my stream APP but it doesn't work on UFs.

Can anybody help me with this problem?

Thanks.

Re: deploying stream forwarder to universal forwarders does not work

tscroggins — Sun, 07 Mar 2021 13:59:20 GMT

@sh_tavousi

You're likely missing step 7 under https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/InstallStreamForwarder#Use_the_deployment_server_to_distribute_Splunk_Add-on_for_Stream_Forwarders_to_universal_forwarders. This section doesn't actually describe using a deployment server, but it does at least cover the installation steps necessary.

7. Set Splunk_TA_stream permissions: On Linux and OSX, run the set_permissions.sh script in the Splunk_TA_stream directory.

cd $SPLUNK_HOME/etc/apps/Splunk_TA_stream sudo chmod +x ./set_permissions.sh sudo ./set_permissions.sh

The deployment server can't perform this step without additional help in the form of sudo rules, wrapper scripts, run once inputs, or the use of a separate deployment tools.

Re: deploying stream forwarder to universal forwarders does not work

sh_tavousi — Mon, 08 Mar 2021 06:32:23 GMT

Hi,

I have installed stream TA on windows.

What should I do?

Thanks.

Re: deploying stream forwarder to universal forwarders does not work

tscroggins — Sat, 13 Mar 2021 19:20:46 GMT

@sh_tavousi

Did you read and follow https://wiki.wireshark.org/CaptureSetup/CapturePrivileges? Do other WinPcap clients, e.g. Wireshark, work correctly?

Re: deploying stream forwarder to universal forwarders does not work

Vardhan — Sat, 13 Mar 2021 19:45:16 GMT

Hi,

Install the Splunk_TA_stream in the UF and splunk_app_stream&Splunk_TA_stream in the HF. Go to the Splunk_TA_stream in the UF and config the inputs.conf as mentioned below

[streamfwd://streamfwd]

splunk_stream_app_location = https://HF_IP:8000/en-us/custom/splunk_app_stream/

disabled = 0

index = dns

And go to the Stream App in the HF and do the necessary config as mentioned in the below blog.

https://www.splunk.com/en_us/blog/tips-and-tricks/installing-and-managing-splunk-stream-in-a-distributed-environment.html