Splunk forwarder on OSX

[rickwylie]

Hi,

I installed the Splunk forwarder on OSX 10.9.1 and started the app, which too me to a web page localhost:8000 which failed to load any thing in the browser. I have trawled the splunk docs to find the manual process and run the following command as root

/Applications/Splunk/bin/splunk add forward-server [Splunk server]:9997

When it asks for the splunk username and password I put in the login for my Splunk server, which is working fine and has 2 PC splunk forwarders connected, but I get a "login failed" response.

Should I just install the full Splunk install and create a forwarder in that.

We have an enterprise license.

Thanks in advance

[Ayn]

The credentials are for the local Splunk forwarder, not your Splunk server. If you didn't change these the default values are "admin" with the password "changeme".

[rickwylie]

Awesome thanks!