Unable to initialize modular input streamfwd

[Dan]

Hi,

I'm running this on a Mac. What does the below error mean? I'm not sure what a Macho-o file is.

Unable to initialize modular input "streamfwd" defined inside the app "Splunk_TA_stream": Introspecting scheme=streamfwd: Unable to run "/opt/splunk/6.2beta-223128/etc/apps/Splunk_TA_stream/darwin_x86_64/bin/streamfwd --scheme": child failed to start: Malformed Mach-o file

[Dan · Accepted solution]

This seems to be related to soft-linking the splunk_app_stream directory under etc/apps/
I've untar'ed the apps directly and am no longer seeing the error message, even on 6.2 beta.

[Dan]

Also don't forget to run

 sudo ./setuid 

from the Splunk_TA_Stream directory.

[csharp_splunk]

We've not tested this on 6.2 beta. Are you having the same experience on 6.1?