topic Re: splunkforwarder issue solaris 10 in Getting Data In

splunkforwarder issue solaris 10

filter — Fri, 13 Apr 2012 08:45:46 GMT

I installed splunkforwarder for Sparc without any errors and started the daemon. When I try top connect with in browser (http://hostname:8089 or http://hostname:8000) I get "Page can not be displayed"

Instalation and app start-ul look OK:

Splunk> Take the sh out of IT.

Checking prerequisites...
        Checking mgmt port [8089]: open
        Checking conf files for typos...
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done.
[:root:/opt/splunkforwarder/bin]50 pkginfo -l splunkforwarder
   PKGINST:  splunkforwarder
      NAME:  Splunk Agent
  CATEGORY:  application
      ARCH:  sparc
   VERSION:  4.3.1
   BASEDIR:  /opt
    VENDOR:  Splunk Inc.
      DESC:  Splunk is the search engine for Operational Intelligence.
    PSTAMP:  epm20120302050241
  INSTDATE:  Apr 13 2012 03:39
    STATUS:  completely installed
     FILES:      236 installed pathnames
                  48 directories
                  56 executables
              113542 blocks used (approx)

Any idea ?

Re: splunkforwarder issue solaris 10

MickSheppard — Fri, 13 Apr 2012 09:24:53 GMT

The forwarder doesn't have a webserver for you to connect to.

Re: splunkforwarder issue solaris 10

filter — Fri, 13 Apr 2012 10:14:43 GMT

I was afraid of that. Thank you for taking the time to confirm.

Re: splunkforwarder issue solaris 10

marg224 — Thu, 12 Dec 2013 20:22:32 GMT

Ummmmm....same problem here, but, maybe a little more info as to why? Install directions were followed, but, no port 8000 was set up and nowhere during the install was there anywhere to input that. Sooooo....any suggestions????

Re: splunkforwarder issue solaris 10

kristian_kolb — Thu, 12 Dec 2013 20:48:19 GMT

The Splunk Universal Forwarder is an lightweight agent that does not have a user-friendly GUI running on (default) port 8000. Simple as that.

What it does have is REST manangement interface running on https://your_ip:8089. However you will need to authenticate with your splunk user credentials (yes forwarders can have users too). But the default admin/changeme credentials are blocked from connecting to a forwarder remotely. You can reconfigure your forwarder to accept the default credentials, but it is probably safer to just change the admin password, right?

Hope this helps,