All Apps and Add-ons

Splunk App for Stream: How to enable payload data extraction on Universal Forwarder?


I have installed Splunk App for Stream on the Search head and Splunk TA stream on Universal forwarder.
Also installed Splunk TA stream on the Indexer.
Now I need to extract the payload data also. I am trying enable it, however, nothing working.
What is the CLI option to enable payload extraction on UF and to be visible on SH?

0 Karma



Can you check in splunk log and see what error message you are getting related to Stream. You also need to run the streamfwd binary as root user on Linux hosts . You can see the complete documentation as related to configuration using below link.


0 Karma


Hi Badri,
I am running the streamfwd as root user . I am not seeing any error messages in the splunkd log as well.
I am able to see the stream data without payload.
I have enabled src_content in the UI on Search Head, but the payload data is not showing up.
the same works on a standalone setup though.


0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...