topic Re: Install Splunk UF in Installation

How to install Splunk Universal Forwarder on a Linux server?

molinarf — Wed, 27 Jan 2021 05:40:34 GMT

I know this was probably answered before, but I am not able to find any answers...

I am trying to install the Splunk UF on a Linux server after having to manually uninstall it because of overlapping 7.2.3 (.tgz) and 8.1.0 (.rpm) packages. I am trying to install the 8.1.0 rpm but get the error that it is already installed. When I try to uninstall it since the error says it's installed, then it says that it is already installed. I can't reboot the server because of operations, but would like to have Splunk operational and reporting to the indexer. Can anyone help with guidance on how to overcome this error?

Thank you for any assistance that can be provided.

Re: Install Splunk UF

scelikok — Mon, 25 Jan 2021 21:00:30 GMT

Hi @molinarf,

Did you try upgrading with "rpm -U" ?

Re: Install Splunk UF

molinarf — Mon, 25 Jan 2021 21:32:13 GMT

That doesn't work... It thinks that it is already installed and I can't uninstall it either. I am finding that the only option is to install a version that wasn't previously installed and see how that goes. If it fails, then I will have to submit a case.

Re: Install Splunk UF

gcusello — Tue, 26 Jan 2021 07:40:00 GMT

Hi @molinarf,

try tar!

Ciao.

Giuseppe

Re: Install Splunk UF

isoutamo — Tue, 26 Jan 2021 20:58:05 GMT

Are you log in as root or use sudo?
What rpm -qi splunk\* shows?
r. Ismo

Re: Install Splunk UF

molinarf — Tue, 26 Jan 2021 21:06:53 GMT

After running the command 'rpm -qi splunk\* ', the response was

package splunk is not installed.

Re: Install Splunk UF

isoutamo — Tue, 26 Jan 2021 21:16:03 GMT

Can you try also rpm -qa | egrep splunk and if it found splunk<something> (splunkforwarder....) then it is installed otherwise probably not via rpm. Also put could try rpm -qif /opt/splunkforwarder/bin/splunk or where ever it has installed.
And how about the user id which you are using?

Re: Install Splunk UF

gordo32 — Tue, 26 Jan 2021 21:19:23 GMT

I had a similar problem to this in the past, and if I remember correctly I downloaded the tgz file and did:

sudo tar xvzf /tmp/splunk.tgz -C /opt

This overwrote, and I was able to do "splunk disable boot-start", etc...

Re: Install Splunk UF

molinarf — Tue, 26 Jan 2021 21:36:47 GMT

Here is the results:

rpm -qa | egrep splunk

splunkforwarder-8.1.1-08187535c166.x86_64

rpm -qif /opt/splunkforwarder/bin/splunk

Name: splunkforwarder

Version: 8.1.1

Release: 8.1.1-08187535c166

etc.....

If these commands show that it is installed, why then when I try to do an uninstall to clean up, it tells me it is not installed. Of course, that is why when I try to reinstall, I get the it is already installed.

Thanks!

Re: Install Splunk UF

molinarf — Tue, 26 Jan 2021 21:38:42 GMT

I had done splunk disable boot-start before I uninstalled. The problem was that there was the .tgz and .rpm both installed at the same time. I am trying to clean it up, so that I can properly reinstall. Thanks for the suggestion.

Re: Install Splunk UF

isoutamo — Wed, 27 Jan 2021 07:17:50 GMT

Yes this means that this package is already installed.

Currently better way to install/update it is use yum instead of rpm or def on redhat 8+ versions.

As it it already installed you should do:

sudo yum update ./splunkforwarder-8.x.y-xxxx

where x and/or y is greater than 1 and 1.

If you are still using old os and use rpm then the correct way is

sudo rpm -Uvh --replacepkgs (or --force) ./splunkforwarder-8.x.y-xxxx.rpm

man rpm on that box or google will help you more.

Re: Install Splunk UF

molinarf — Wed, 27 Jan 2021 19:17:08 GMT

I ran the following command as you suggested.

sudo rpm -Uvh --replacepkgs (or --force) ./splunkforwarder-8.x.y-xxxx.rpm

It seemed to install fine, but it never reported into the indexer. I did some poking around in man rpm and decided to run

rpm -evv --test splunkforwarder-8.x.y-xxxx.rpm

What returned looked like it would uninstall fine. I checked the splunkd.log to see if there was any indications or error related to the installation or in fact anything and I found none, so my assumption is that everything is supposed to be okay. My next step was to stop splunk and then uninstall. I ran the uninstall command from /opt/splunkforwarder/bin since I was there

rpm -e splunkforwarder-8.x.y-xxxx.rpm

I received the following message: Warning: file /opt/splunkforwarder/ftr: remove failed: no such file or directory. I guess I was in the wrong directory so I reran the command from /opt and this error appeared

Error returned "package splunkforwarder-8.x.y-xxxx.rpm is not installed. Anyway, I looked in the directory and the splunkforwarder directory was there. I checked it and found only etc and var was there. So I am not sure if it would be prudent for me to remove the splunk forwarder directory and reinstall, like maybe using tar splunkforwarder-8.x.y-xxxx.tgz? I look forward to your response. Thank you

Re: Install Splunk UF

isoutamo — Thu, 28 Jan 2021 13:59:52 GMT

When you are removing package, don't use .rpm on name, just package name and if needed version etc. Also don't be on a directory which belongs to package when you are trying to remove it. It usually try to remove that directory too.

https://www.tecmint.com/20-practical-examples-of-rpm-commands-in-linux/

And always use sudo rpm or first switch to user root.

I hope that these instructions helps you.

And finally don't install with tar until you have removed package with rpm, otherwise you have invalid rpm db catalog on your host and it will generate later other issues!

r. Ismo

Re: Install Splunk UF

molinarf — Thu, 28 Jan 2021 17:00:49 GMT

Per Support, I did do the installation using the tar file

sudo tar xvzf /tmp/splunk.tgz

Splunk is there, just like when I do the .rpm. The problem I am faced with is that it isn't communicating with the indexer. I may have to just remove the UF all together until that server is rebuilt.

Re: Install Splunk UF

molinarf — Thu, 28 Jan 2021 17:05:14 GMT

I did try that too. Even when I do the rpm -e splunk8.x.y... it still told me that it was not installed. Support had me do the install with the tar file. I now have the UF installed, but the problem now is that the it is not communicating with the indexer.

Re: Install Splunk UF

isoutamo — Thu, 28 Jan 2021 18:17:16 GMT

Have you create outputs.conf or app which define where your indexer(s) is/are?or hav you add DS information to this UF?

Re: Install Splunk UF

molinarf — Thu, 28 Jan 2021 18:36:06 GMT

There is an outputs.conf file which is showing that there is an indexer and listening on port 9997, but it is showing as inactive. There is no DS (Deployment server) that is listed.

Re: Install Splunk UF

isoutamo — Thu, 28 Jan 2021 18:54:29 GMT

What you are seeing on UF’s splunkd.log and metrics.log?

Re: Install Splunk UF

molinarf — Thu, 28 Jan 2021 19:11:54 GMT

splunkd.log shows that everything seems to be working fine. In the metrics log, it seems that there is nothing collected and sent, but not really sure about it. I did find that there is this line that makes it seem that it is trying to communicate with the indexer and DS.

INFO StatusMgr - destHost=<ip>, destIp=<ip>, destPort=9997, eventType=connect_try, publisher=Tcpout, sourcePort=8089, statusee=TCPOutputProcessor

INFO StatusMgr - destHost=<ip>, destIp=<ip>, destPort=9997, eventType=connect_fail, publisher=Tcpout, sourcePort=8089, statusee=TCPOutputProcessor

Re: Install Splunk UF

isoutamo — Thu, 28 Jan 2021 20:16:54 GMT

It tried and fail. Usually the reason can found front splunkd.log on UF and/or Indexer.
Also curl or tcpdump from cmd line can used to check why it fails.