Upgrade UF package credential

[tbavarva]

Hi all,
We are trying to upgrade UF package credential in our intermediate forwarders (including HFs).

PFB steps which I followed:
1. Login to SH
2. Go to apps --> Universal Forwarder
3. splunkclouduf.spl file downloaded and installed on HFs via GUI.

But when it came to UFs, I am not sure whether GUI was enabled or UF has GUI so I had to copy the 100_splunkcloud app folder (from HF) and pasted into apps folder in UF.

Then I restarted UF. And started getting error: can't read key file.

I am sure I am missing something while doing this task in UF.

Could someone please help?

Thanks in advance.

Regards,
Tejas

[tbavarva · Accepted solution]

Thanks a lot Rich.

Your comment helped me to upgrade credential package of UF.

The steps you followed sound correct. Try again, but this time extract splunkclouduf.spl into the UF's apps directory instead of copying it from the HF. Use tar -zxf splunkclouduf.spl -C /opt/splunkforwarder/etc/apps to extract the app.

Regards,
Tejas

[richgalloway]

The steps you followed sound correct. Try again, but this time extract splunkclouduf.spl into the UF's apps directory instead of copying it from the HF. Use tar -zxf splunkclouduf.spl -C /opt/splunkforwarder/etc/apps to extract the app.

[tbavarva]

Below link is the one?
https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/User/ForwardDataToSplunkCloudFromLinux

Regards,
Tejas