Why am I getting an error installing Splunk Add-on for Unix and Linux on Ubuntu with 6.1.3 universal forwarder?

[gregwilliams]

After I have installed the TA on a 12.04 Ubuntu box with the latest 6.1.3 universal forwarder on it, I get this error: /opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/setup.sh: 18: /opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/setup.sh: Syntax error: "(" unexpected

Any ideas?

[jcoates_splunk · Accepted solution]

okay, the problem is that Ubuntu is using dash instead of bash, and it doesn't handle execution in the same way (http://unix.stackexchange.com/questions/45781/shell-script-fails-syntax-error-unexpected for lots of detail). There's a number of workarounds possible, probably the easiest one is to ln -s /bin/bash /bin/sh

[gregwilliams]

Thanks. I wasn't thinking it was an environment issue. Since I already had a link setup, I just changed the shebang to #!/bin/bash instead of #!/bin/sh. Then I had more errors with the execution, so I executed this:

sed -i 's|$SPLUNK_HOME|/opt/splunkforwarder|g' ./setup.sh

worked fine then.

[GregBrant]

@gregwilliams you should post your comment as an answer as it directly fixes the problem. I would up vote it.

[gregwilliams]

copied the unpacked tar file to the $SPLUNKFORWARDER_HOME/etc/apps/ directory, restarted the forwarder and then tried to run $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/setup.sh

[jcoates_splunk]

How are you running the setup?