Getting Data In

Manually Installing Splunk Forwarder

_gkollias
SplunkTrust
SplunkTrust

I'd like to start forwarding data from a server which is now "unsupported". Normally, I would install a forwarder by using wget to fetch the installation driver from our Splunk prod, however we weren't able to find the dependencies needed to install wget on the machine.

I believe I can manually install the forwarder and then hand-configure some conf files in etc/system/local.

Does anyone know how to manually install a Splunk forwarder in this use case?

Thank You

Tags (3)
0 Karma
1 Solution

phoffman_splunk
Splunk Employee
Splunk Employee

I am not sure I understand your question.

wget is just a method for retrieving content from the web, I have never had to "install" that on any distro. (http://en.wikipedia.org/wiki/Wget)

If you can't directly download the UF install package on your machine, you can download it on another machine and use scp to copy it over to where you want to install it.

I would recommend using the tar file install method.

(http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/InstallonLinux)
(http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Deploymentoverview)

View solution in original post

phoffman_splunk
Splunk Employee
Splunk Employee

I am not sure I understand your question.

wget is just a method for retrieving content from the web, I have never had to "install" that on any distro. (http://en.wikipedia.org/wiki/Wget)

If you can't directly download the UF install package on your machine, you can download it on another machine and use scp to copy it over to where you want to install it.

I would recommend using the tar file install method.

(http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/InstallonLinux)
(http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Deploymentoverview)

phoffman_splunk
Splunk Employee
Splunk Employee

you get the installation downloads from http://www.splunk.com/download and configure the instance using the docs links above.

_gkollias
SplunkTrust
SplunkTrust

Exactly, so essentially all we use wget for is to download the scripts, splunk install stuff, etc from one of our search heads. Since we can't retrieve that stuff in that way, I will be manually installing the forwarder. Thanks for the links!

0 Karma

_gkollias
SplunkTrust
SplunkTrust

The main point is that since we are unable to install 'wget' I will need to install the forwarder manually. I guess I'm unfamiliar with which package I would need. I'll research that info. Thanks.

0 Karma

kristian_kolb
Ultra Champion

What do you mean with 'unsupported'? Unsupported by your organization or unsupported by Splunk?

If the former, then just install the correct package (deb, RPM, pkg, MSI etc) or unpack the .tgz in /opt/splunkforwarder. Then configure your installtion accordingly.

If the latter, you're on your own.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...