All Apps and Add-ons

Error with Splunk Stream: Unable to initialize modular input "streamfwd" defined inside the app "Splunk_TA_stream"

akshatj2
Path Finder

Hi All,

We are receiving below error in Splunk Stream App

we have installed a separate Universal forwarder and installed the Stream Add-on on it to read PCAP files. Any help on the same would be helpful.

Unable to initialize modular input "streamfwd" defined inside the app "Splunk_TA_stream": Introspecting scheme=streamfwd: script running failed (exited with code 1).

0 Karma

iandrews_splunk
Splunk Employee
Splunk Employee

Stream doesn't support universal forwarders. You'll have to install it on a Heavy Forwarder (Splunk Enterprise, configured like a forwarder)

Also, make sure you follow the setup instructions (http://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream)

0 Karma

ehudb
Contributor

According to the official guide, it does support universal forwarder:

https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream#Manu...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...