topic Re: Problem with forwarder installing in Installation

Problem with forwarder installing- How to resolve error?

bosseres — Fri, 14 Oct 2022 14:45:02 GMT

Hello everyone,

I am trying to install forwarder on Linux

chown -R splunk:splunk /opt/splunkforwarder

sudo -u splunk sh -c "/opt/splunkforwarder/bin/splunk set deploy-poll deployment_address:8089"

and getting error: sh: /opt/splunkforwarder/bin/splunk: Permission denied

What should I look? What can be problem?

Re: Problem with forwarder installing

gcusello — Fri, 14 Oct 2022 06:54:20 GMT

Hi @bosseres,

I usually create an Add-On, called TA_Forwarders, containing two fields:

deployment clients.conf (to address the Deployment Server),
outputs.conf (to address the Indexers).

than I copy them in $SPLUNK_HOME/etc/apps and restart Splunk.

Then I deploy this app to all Forwarders using Deplyment Server, in this way I can manage eventual Deployment Server or Indexers change.

using teh command you shared, the conf file deploymentclient.conf is located in $SPLUNK_HOME/etc/system/local.

You could also manually put the deploymentclient.conf file in the above folder, but I hint to use the custom Add-On.

For more infos about how to create the deploymentclient.conf file see at https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Deploymentclientconf

[deployment-client] [target-broker:deploymentServer] targetUri= https://<Deployment_server_hostname_or_ip:8089

Ciao.

Giuseppe

Re: Problem with forwarder installing

bosseres — Fri, 14 Oct 2022 07:33:19 GMT

Hi @gcusello, thank you for your help.

Yes I can manually put the deploymentclient.conf, but I don't understand why I can't to do it through command sudo -u splunk sh -c "/opt/splunkforwarder/bin/splunk set deploy-poll deployment_address:8089", why Permission denied?

Re: Problem with forwarder installing

gcusello — Fri, 14 Oct 2022 07:45:57 GMT

hi @bosseres,

I should see your system, anyway, if you promote your user to su, does your command run?

And anyway, as I said, if you use the above command, it writes the file in $SPLUNK_HOME/etc/system/local and then you cannot manage it by Deployment Server, so I do not recommend to use it: the TA_Forwarder Add-On is the best approach.

Ciao.

Giuseppe