Splunk App for Stream: How to enable payload data extraction on Universal Forwarder?

[bkumarm]

I have installed Splunk App for Stream on the Search head and Splunk TA stream on Universal forwarder.
Also installed Splunk TA stream on the Indexer.
Now I need to extract the payload data also. I am trying enable it, however, nothing working.
What is the CLI option to enable payload extraction on UF and to be visible on SH?

[badrinath_itrs]

Hi,

Can you check in splunk log and see what error message you are getting related to Stream. You also need to run the streamfwd binary as root user on Linux hosts . You can see the complete documentation as related to configuration using below link.

http://docs.splunk.com/Documentation/StreamApp/6.4.2/DeployStreamApp/InstallSplunkAppforStream

Regards,
Badri

[bkumarm]

Hi Badri,
I am running the streamfwd as root user . I am not seeing any error messages in the splunkd log as well.
I am able to see the stream data without payload.
I have enabled src_content in the UI on Search Head, but the payload data is not showing up.
the same works on a standalone setup though.

Thanks,
Bharath