Our central Splunk server is Linux, running (now) the latest as I suspected there was a bug involved in this situation. I've deployed the Windows universal forwarder to a bunch of Windows Server 2008 machines, and due to a known bug in the installer (as shown to me by Splunk support) they had to be installed with no options, and configured after. Since there are a lot of machines, I'm attempting to automate everything.
Whenever I attempt to add in a monitor via the splunk command on our Linux server, I get an error. This is what it is:
splunk add monitor
In handler 'monitor': Parameter name: Path does not exist.
It sounds like the monitor is only validated against what's valid for the local OS. Is this expected behavior or a bug? I've attempted the usual UNIX tricks -- encased the path in quotes, escaped the special characters, etc.
Hi lukejadamec, this is not completely true .... you can use the CLI from the indexer to add a monitor on the forwarder. It's just not allowed by default - you must enable allowRemoteLogin in the server.conf of the forwarder. After that you can add a monitor remotely. BTW, with exception of the start, stop, restart, status and version command, all that control the splunkd, you can run all CLI commands remotely.
Thanks MuS.
Hi lukejadamec, this is not completely true .... you can use the CLI from the indexer to add a monitor on the forwarder. It's just not allowed by default - you must enable allowRemoteLogin
in the server.conf
of the forwarder. After that you can add a monitor remotely. BTW, with exception of the start
, stop
, restart
, status
and version
command, all that control the splunkd, you can run all CLI commands remotely.
Note that I'm not entering the path as