Splunk App for Stream. deploying onto Windows

[realgandy]

Hi

Pretty new to Splunk and trying to get to grips with deployment of apps.

I have a deployment server running on Linux and am trying to deploy the splunk app for stream out to a windows server, running universal forwarder, to capture wire data on the windows server.

The deployment appears to work as I get the relevant splunk_TA_stream directory created under apps.

I've looked at all the documentation a hundred times and checked all config files and they appear to contain all the right info, yet no wire capture ever happens.

Has anyone actually got this to work, and if so are you able to offer some direction for me?

Many thanks
Gary

[Richfez · Accepted solution]

You don't mention installing winpcap on the endpoints. Winpcap is the underlying packet sniffer that Splunk App for Stream relies on to actually capture packets. You can't install winpcap through Splunk, so it's got to be deployed manually or via some other Windows-y method, like SCCM.

If you don't have that, please install it, restart everything involved and see if it doesn't help. For what its worth, it's a tiny, fast, and non-invasive install.

[realgandy]

Thanks.

That wasn't the only issue though (not seen that pre-req in any document, maybe I just missed it)... The streamfwd logfile location was a bit screwed in the log4j config file. Corrected that in the local version and now all is working.

Many Thanks for your help