All Apps and Add-ons

Why am I getting an error installing Splunk Add-on for Unix and Linux on Ubuntu with 6.1.3 universal forwarder?

gregwilliams
Path Finder

After I have installed the TA on a 12.04 Ubuntu box with the latest 6.1.3 universal forwarder on it, I get this error: /opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/setup.sh: 18: /opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/setup.sh: Syntax error: "(" unexpected

Any ideas?

1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

okay, the problem is that Ubuntu is using dash instead of bash, and it doesn't handle execution in the same way (http://unix.stackexchange.com/questions/45781/shell-script-fails-syntax-error-unexpected for lots of detail). There's a number of workarounds possible, probably the easiest one is to ln -s /bin/bash /bin/sh

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

okay, the problem is that Ubuntu is using dash instead of bash, and it doesn't handle execution in the same way (http://unix.stackexchange.com/questions/45781/shell-script-fails-syntax-error-unexpected for lots of detail). There's a number of workarounds possible, probably the easiest one is to ln -s /bin/bash /bin/sh

View solution in original post

gregwilliams
Path Finder

Thanks. I wasn't thinking it was an environment issue. Since I already had a link setup, I just changed the shebang to #!/bin/bash instead of #!/bin/sh. Then I had more errors with the execution, so I executed this:

sed -i 's|$SPLUNK_HOME|/opt/splunkforwarder|g' ./setup.sh

worked fine then.

GregBrant
Engager

@gregwilliams you should post your comment as an answer as it directly fixes the problem. I would up vote it.

0 Karma

gregwilliams
Path Finder

copied the unpacked tar file to the $SPLUNKFORWARDER_HOME/etc/apps/ directory, restarted the forwarder and then tried to run $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/setup.sh

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

How are you running the setup?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!