https://community.splunk.com/t5/Monitoring-Splunk/How-to-properly-setup-splunkforwarder-in-CentOS-6-8/m-p/321017#M2964 <P>Use the same commands to start, stop or restart Splunk - regardless of whether it is a forwarder, an indexer or any other kind of Splunk instance:</P> <PRE><CODE>/opt/splunkforwarder/bin/splunk start /opt/splunkforwarder/bin/splunk stop /opt/splunkforwarder/bin/splunk restart </CODE></PRE> <P>Also, be sure that you are using the right user account to start Splunk. For example, if you created a user account named "splunkIT" to run the forwarder, be sure that you use that account to run the start command. And all the files in the /opt/splunkforwarder directory (and subdirectories) must be owned by "splunkIT" - or whatever account that you used.</P> Wed, 22 Feb 2017 07:43:11 GMT lguinn2 2017-02-22T07:43:11Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-properly-setup-splunkforwarder-in-CentOS-6-8/m-p/321016#M2963 <P>Hi,<BR /> I'm trying to setup splunkforwarder in a new Linux server (CentOS 6.8), but every time I try to run splunkd, I get the following error:</P> <PRE><CODE># /opt/splunkforwarder/bin/splunkd Couldn't open log file configuration "/etc/log.cfg": No such file or directory Error loading logging config file </CODE></PRE> <P>The problem is, the "log.cfg" file is currently contained within the path "/opt/splunkforwarder/etc/log.cfg" and I couldn't find a way to fix splunkd in order to make it look within "/opt/splunkforwarder/etc/" instead of "/etc/".</P> <P>Any advice? I couldn't find the documentation to do it properly. Please let me know if there is a proper standard way to fix it, I don't want to reinvent the wheel.</P> <P>Thanks in advance. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 21 Feb 2017 15:02:06 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-properly-setup-splunkforwarder-in-CentOS-6-8/m-p/321016#M2963 ggs_admin 2017-02-21T15:02:06Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-properly-setup-splunkforwarder-in-CentOS-6-8/m-p/321017#M2964 <P>Use the same commands to start, stop or restart Splunk - regardless of whether it is a forwarder, an indexer or any other kind of Splunk instance:</P> <PRE><CODE>/opt/splunkforwarder/bin/splunk start /opt/splunkforwarder/bin/splunk stop /opt/splunkforwarder/bin/splunk restart </CODE></PRE> <P>Also, be sure that you are using the right user account to start Splunk. For example, if you created a user account named "splunkIT" to run the forwarder, be sure that you use that account to run the start command. And all the files in the /opt/splunkforwarder directory (and subdirectories) must be owned by "splunkIT" - or whatever account that you used.</P> Wed, 22 Feb 2017 07:43:11 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-properly-setup-splunkforwarder-in-CentOS-6-8/m-p/321017#M2964 lguinn2 2017-02-22T07:43:11Z