STATUS ERROR STREAM FOWARDER IN SPLUNK STREAM APP

[adrojis]

Hi to everyone, 

I have recently installed Splunk enterprise (9.1.2) on an ubuntu 20.04 with the add-on "Splunk App for Stream" (8.1.1). . On another VM (also ubuntu 20.04, IP : 192.168.182.134 ) I put my UF (9.1.2). In the UF, I put the add-on "Splunk Add-on for Stream Forwarders" (8.1.1) to capture stream/packets.

My streamfwd.conf file is :

[streamfwd]
logConfig = streamfwdlog.conf
port = 8889
ipAddr = 192.168.182.134
netflowReceiver.0.decodingThreads = 4
indexer.0.uri = http://192.168.182.132:8088

[streamfwdcapture]
netflowReceiver.0.ip = 192.168.182.134
netflowReceiver.0.interface = ens33
netflowReceiver.0.port = 9995
netflowReceiver.0.decoder = netflow

And in my streamfwd.log I have this :

2024-02-12 01:28:47 INFO [140717870847936] (CaptureServer.cpp:817) stream.CaptureServer - Found DataDirectory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/data
2024-02-12 01:28:47 INFO [140717870847936] (CaptureServer.cpp:823) stream.CaptureServer - Found UIDirectory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/ui
2024-02-12 01:28:47 INFO [140717870847936] (CaptureServer.cpp:896) stream.CaptureServer - Default configuration directory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/default
2024-02-12 01:28:53 INFO [140717870847936] (CaptureServer.cpp:1918) stream.CaptureServer - Netflow receiver configuration defined; disabling default automatic promiscuous mode packet capture on all available interfaces. Configure one or more streamfwdcapture parameters in streamfwd.conf to enable network packet capture.
2024-02-12 01:28:53 INFO [140717870847936] (SnifferReactor/SnifferReactor.cpp:327) stream.SnifferReactor - No packet processors configured
2024-02-12 01:28:54 INFO [140717870847936] (CaptureServer.cpp:2001) stream.CaptureServer - Starting data capture
2024-02-12 01:28:54 INFO [140717870847936] (SnifferReactor/SnifferReactor.cpp:161) stream.SnifferReactor - Starting network capture: sniffer
2024-02-12 01:28:54 INFO [140717870847936] (CaptureServer.cpp:2362) stream.CaptureServer - Done pinging stream senders (config was updated)
2024-02-12 01:28:54 INFO [140717870847936] (main.cpp:1109) stream.main - streamfwd has started successfully (version 8.1.1 build afdcef4b)
2024-02-12 01:28:54 INFO [140717870847936] (main.cpp:1111) stream.main - web interface listening on port 8889

But, in my splunk_stream_app I have this : 

If anyone can help me to fix this issue, I will be glad to read it.

[scelikok]

Unfortunately, I didn't get NetFlow using Stream before. I cannot  think anything else.

[scelikok]

Hi @adrojis,

Did you run set_permissions.sh on your forwarder? You should have done it manually on the UF host.

cd $SPLUNK_HOME/etc/apps/Splunk_TA_stream
sudo chmod +x ./set_permissions.sh
sudo ./set_permissions.sh

Install Splunk Add-on for Stream Forwarder

[adrojis]

Hi,

Yes I have already run set_permissions.sh on my forwarder but it didn't change anything.

Do you have any other recommandation ?