Hi All,
We are receiving below error in Splunk Stream App
we have installed a separate Universal forwarder and installed the Stream Add-on on it to read PCAP files. Any help on the same would be helpful.
Unable to initialize modular input "streamfwd" defined inside the app "Splunk_TA_stream": Introspecting scheme=streamfwd: script running failed (exited with code 1).
Stream doesn't support universal forwarders. You'll have to install it on a Heavy Forwarder (Splunk Enterprise, configured like a forwarder)
Also, make sure you follow the setup instructions (http://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream)
According to the official guide, it does support universal forwarder: