Manually Installing Splunk Forwarder

[_gkollias]

I'd like to start forwarding data from a server which is now "unsupported". Normally, I would install a forwarder by using wget to fetch the installation driver from our Splunk prod, however we weren't able to find the dependencies needed to install wget on the machine.

I believe I can manually install the forwarder and then hand-configure some conf files in etc/system/local.

Does anyone know how to manually install a Splunk forwarder in this use case?

Thank You

[phoffman_splunk · Accepted solution]

I am not sure I understand your question.

wget is just a method for retrieving content from the web, I have never had to "install" that on any distro. (http://en.wikipedia.org/wiki/Wget)

If you can't directly download the UF install package on your machine, you can download it on another machine and use scp to copy it over to where you want to install it.

I would recommend using the tar file install method.

(http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/InstallonLinux)
(http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Deploymentoverview)

[phoffman_splunk]

you get the installation downloads from http://www.splunk.com/download and configure the instance using the docs links above.

[_gkollias]

Exactly, so essentially all we use wget for is to download the scripts, splunk install stuff, etc from one of our search heads. Since we can't retrieve that stuff in that way, I will be manually installing the forwarder. Thanks for the links!

[_gkollias]

The main point is that since we are unable to install 'wget' I will need to install the forwarder manually. I guess I'm unfamiliar with which package I would need. I'll research that info. Thanks.

[kristian_kolb]

What do you mean with 'unsupported'? Unsupported by your organization or unsupported by Splunk?

If the former, then just install the correct package (deb, RPM, pkg, MSI etc) or unpack the .tgz in /opt/splunkforwarder. Then configure your installtion accordingly.

If the latter, you're on your own.