https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228266#M44476 <P>Ah Gotcha! I'm assuming you got the correct linux version for the forwarder? Once I ran tar xvzf on the .tgz file, I was able to run ./splunk commands. </P> Mon, 03 Oct 2016 16:48:34 GMT Michael_Carlisl 2016-10-03T16:48:34Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228263#M44473 <P>Got the universal forwarder installed on my Isilon. (/opt/Splunk/splunkforwarder/)<BR /> Trying to follow the directions to start the service up but its not working. I'm not a Linux guy...</P> <PRE><CODE>ktfs01-2# cd /opt/Splunk/splunkforwarder ktfs01-2# ./splunk start ELF binary type "0" not known. zsh: exec format error: ./splunk ktfs01-2# ls btool bzip2 copyright.txt genSignedServerCert.sh openssl scripts splunk splunkdj srm btprobe classify genRootCA.sh genWebCert.sh pid_check.sh setSplunkEnv splunkd splunkmon ktfs01-2# </CODE></PRE> Mon, 03 Oct 2016 16:01:44 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228263#M44473 jasondillard74 2016-10-03T16:01:44Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228264#M44474 <P>Interesting that your splunk executable is not in /opt/Splunk/splunkforwarder/bin. Do you have a bin in SPLUNKHOME?</P> Mon, 03 Oct 2016 16:15:20 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228264#M44474 Michael_Carlisl 2016-10-03T16:15:20Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228265#M44475 <P>It is in bin actually.... sorry, accidentally left that part out of the path above.</P> Mon, 03 Oct 2016 16:21:59 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228265#M44475 jasondillard74 2016-10-03T16:21:59Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228266#M44476 <P>Ah Gotcha! I'm assuming you got the correct linux version for the forwarder? Once I ran tar xvzf on the .tgz file, I was able to run ./splunk commands. </P> Mon, 03 Oct 2016 16:48:34 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228266#M44476 Michael_Carlisl 2016-10-03T16:48:34Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228267#M44477 <P>I don't know what the deal is... I downloaded the x64 version straight from Splunks site. <BR /> Here's a better rundown on my Putty. I renamed the file to splunk.tgz, then copied it to the /opt/Splunk/ folder via WinSCP. When I extracted it, It created the splunkforwarder folder and all underlying files/folders.</P> <P>ktfs01-2# tar xvzf splunk.tgz<BR /> x splunkforwarder/<BR /> x splunkforwarder/etc/<BR /> x splunkforwarder/etc/deployment-apps/<BR /> x splunkforwarder/etc/deployment-apps/README............................etc. </P> <P>ktfs01-2# cd /opt/Splunk/splunkforwarder/bin<BR /> ktfs01-2# ./splunk start<BR /> ELF binary type "0" not known.<BR /> zsh: exec format error: ./splunk<BR /> ktfs01-2#</P> Mon, 03 Oct 2016 16:57:08 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-start-Splunk-Universal-Forwarder-after/m-p/228267#M44477 jasondillard74 2016-10-03T16:57:08Z