A universal forwarder asks me to start splunk when i try to use the cli. Has anyone else experienced this or similar behaviour?
-bash-3.00$ pwd
/opt/splunkforwarder
-bash-3.00$ bin/splunk status
splunkd is running (PID: 21821).
splunk helpers are running (PIDs: 21822).
-bash-3.00$ bin/splunk list monitor
Splunk is not running, and it must be for this operation. To start splunk, run "splunk start".
-bash-3.00$ /opt/splunkforwarder/bin/splunk
couldn't run "/opt/splunkforwarder/bin/python": No such file or directory
-bash-3.00$ bin/splunk start
The splunk daemon (splunkd) is already running.
-bash-3.00$
Ok, this is kind of embarrassing but maybe someone will run into the same issue.
We disabled the management port on our forwarders for security reasons a while ago in the server.conf file, that was the problem. Comenting out the following lines helped:
[httpServer]
disableDefaultPort = true
Here's another one, in the hopes that it will help someone.
In our etc/system/local/server.conf, we had:
[sslConfig] requireClientCert = true
This was causing the following errors:
02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0 02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - SSL Error for fd from HOST:localhost, IP:127.0.0.1, PORT:34566
Changing "requireClientCert" to "false" did the trick.
Ok, this is kind of embarrassing but maybe someone will run into the same issue.
We disabled the management port on our forwarders for security reasons a while ago in the server.conf file, that was the problem. Comenting out the following lines helped:
[httpServer]
disableDefaultPort = true