All Apps and Add-ons

Splunk App for Stream. deploying onto Windows

realgandy
Explorer

Hi

Pretty new to Splunk and trying to get to grips with deployment of apps.

I have a deployment server running on Linux and am trying to deploy the splunk app for stream out to a windows server, running universal forwarder, to capture wire data on the windows server.

The deployment appears to work as I get the relevant splunk_TA_stream directory created under apps.

I've looked at all the documentation a hundred times and checked all config files and they appear to contain all the right info, yet no wire capture ever happens.

Has anyone actually got this to work, and if so are you able to offer some direction for me?

Many thanks
Gary

Tags (1)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

You don't mention installing winpcap on the endpoints. Winpcap is the underlying packet sniffer that Splunk App for Stream relies on to actually capture packets. You can't install winpcap through Splunk, so it's got to be deployed manually or via some other Windows-y method, like SCCM.

If you don't have that, please install it, restart everything involved and see if it doesn't help. For what its worth, it's a tiny, fast, and non-invasive install.

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

You don't mention installing winpcap on the endpoints. Winpcap is the underlying packet sniffer that Splunk App for Stream relies on to actually capture packets. You can't install winpcap through Splunk, so it's got to be deployed manually or via some other Windows-y method, like SCCM.

If you don't have that, please install it, restart everything involved and see if it doesn't help. For what its worth, it's a tiny, fast, and non-invasive install.

0 Karma

realgandy
Explorer

Thanks.

That wasn't the only issue though (not seen that pre-req in any document, maybe I just missed it)... The streamfwd logfile location was a bit screwed in the log4j config file. Corrected that in the local version and now all is working.

Many Thanks for your help

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...