All Apps and Add-ons

Splunk Stream Confusion



I'm trying to install Splunk Stream in a distributed environment but the more I read the more confused I'm getting and less I understand!

I have a distribution server deploying the Stream_TA_stream app to a universal forwarder on a Windows 10 PC ( and this looks to be successful as I'm seeing the app along with my inputs.conf. Within my inputs.conf I have the splunk_stream_app_location set as is my Splunk Stream server with splunk_app_stream and splunk_TA_stream_wire_data installed. Under the Stream App config I have created a test stream looking for ICMP and under Distributed Forwarder Management a group with HEC off and an endpoint URL 

In Matched Forwarders should I be seeing my Win10 PC in the Preview of matched Forwarders?

I have used Wireshark and can see comms on tcp port 8000 including the http 'ping' and an http 200 OK response but no other communications on any other port. Can anyone shed some light on what should happen next and how the Stream config is ‘shared’?

Any help/advise would be greatly appreciated.



Labels (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!