Getting Data In

Manually Installing Splunk Forwarder

_gkollias
SplunkTrust
SplunkTrust

I'd like to start forwarding data from a server which is now "unsupported". Normally, I would install a forwarder by using wget to fetch the installation driver from our Splunk prod, however we weren't able to find the dependencies needed to install wget on the machine.

I believe I can manually install the forwarder and then hand-configure some conf files in etc/system/local.

Does anyone know how to manually install a Splunk forwarder in this use case?

Thank You

Tags (3)
0 Karma
1 Solution

phoffman_splunk
Splunk Employee
Splunk Employee

I am not sure I understand your question.

wget is just a method for retrieving content from the web, I have never had to "install" that on any distro. (http://en.wikipedia.org/wiki/Wget)

If you can't directly download the UF install package on your machine, you can download it on another machine and use scp to copy it over to where you want to install it.

I would recommend using the tar file install method.

(http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/InstallonLinux)
(http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Deploymentoverview)

View solution in original post

phoffman_splunk
Splunk Employee
Splunk Employee

I am not sure I understand your question.

wget is just a method for retrieving content from the web, I have never had to "install" that on any distro. (http://en.wikipedia.org/wiki/Wget)

If you can't directly download the UF install package on your machine, you can download it on another machine and use scp to copy it over to where you want to install it.

I would recommend using the tar file install method.

(http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/InstallonLinux)
(http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Deploymentoverview)

phoffman_splunk
Splunk Employee
Splunk Employee

you get the installation downloads from http://www.splunk.com/download and configure the instance using the docs links above.

_gkollias
SplunkTrust
SplunkTrust

Exactly, so essentially all we use wget for is to download the scripts, splunk install stuff, etc from one of our search heads. Since we can't retrieve that stuff in that way, I will be manually installing the forwarder. Thanks for the links!

0 Karma

_gkollias
SplunkTrust
SplunkTrust

The main point is that since we are unable to install 'wget' I will need to install the forwarder manually. I guess I'm unfamiliar with which package I would need. I'll research that info. Thanks.

0 Karma

kristian_kolb
Ultra Champion

What do you mean with 'unsupported'? Unsupported by your organization or unsupported by Splunk?

If the former, then just install the correct package (deb, RPM, pkg, MSI etc) or unpack the .tgz in /opt/splunkforwarder. Then configure your installtion accordingly.

If the latter, you're on your own.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...