Error with Splunk Stream: Unable to initialize modular input "streamfwd" defined inside the app "Splunk_TA_stream"

[akshatj2]

Hi All,

We are receiving below error in Splunk Stream App

we have installed a separate Universal forwarder and installed the Stream Add-on on it to read PCAP files. Any help on the same would be helpful.

Unable to initialize modular input "streamfwd" defined inside the app "Splunk_TA_stream": Introspecting scheme=streamfwd: script running failed (exited with code 1).

[iandrews_splunk]

Stream doesn't support universal forwarders. You'll have to install it on a Heavy Forwarder (Splunk Enterprise, configured like a forwarder)

Also, make sure you follow the setup instructions (http://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream)

[ehudb]

According to the official guide, it does support universal forwarder:

https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream#Manu...