streamfwd is working well on my Windows machines but not on my Amazon Linux AMI instances. Only using the 'defaultgroup' for Distributed Forwarder Management within Splunk Stream App UI. Pushing out the Stream TA with the Deployment Server.
Splunk is not running on root so I followed these instructions while logged in as the splunk process owner: http://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/InstallSplunkAppforStream#Set_...
Seeing stuff like this in streamfwd.log (nothing catching my eye in splunkd.log):
FATAL  (main.cpp:1149) stream.main - Failed to start streamfwd, the process will be terminated: No <stanza> found in <configuration>
I've also tried setting
streamfwd.conf as follows to capture all interfaces:
[streamfwd] streamfwdcapture.0.interfaceRegex = .*
Anyone experienced this or have expertise on this? Thanks ahead of time!
I do! Sorry for not being clear on that, but I thought it was implied by the fact that I am in fact getting data from the Windows machines, just not the Linux ones.
In case it helps, here's what I'm rocking so far:
[streamfwd://streamfwd] splunk_stream_app_location = https://awesomeurlhere:coolport/en-us/custom/splunk_app_stream/ stream_forwarder_id = index = cool_index_here