Getting Data In

Why am I unable to start Splunk Universal Forwarder after installing on Isilon/Linux?

jasondillard74
New Member

Got the universal forwarder installed on my Isilon. (/opt/Splunk/splunkforwarder/)
Trying to follow the directions to start the service up but its not working. I'm not a Linux guy...

ktfs01-2# cd /opt/Splunk/splunkforwarder
ktfs01-2# ./splunk start
ELF binary type "0" not known.
zsh: exec format error: ./splunk
ktfs01-2# ls
btool                   bzip2                   copyright.txt           genSignedServerCert.sh  openssl                 scripts                 splunk                  splunkdj                srm
btprobe                 classify                genRootCA.sh            genWebCert.sh           pid_check.sh            setSplunkEnv            splunkd                 splunkmon
ktfs01-2#
0 Karma

Michael_Carlisl
Explorer

Interesting that your splunk executable is not in /opt/Splunk/splunkforwarder/bin. Do you have a bin in SPLUNKHOME?

0 Karma

jasondillard74
New Member

It is in bin actually.... sorry, accidentally left that part out of the path above.

0 Karma

Michael_Carlisl
Explorer

Ah Gotcha! I'm assuming you got the correct linux version for the forwarder? Once I ran tar xvzf on the .tgz file, I was able to run ./splunk commands.

0 Karma

jasondillard74
New Member

I don't know what the deal is... I downloaded the x64 version straight from Splunks site.
Here's a better rundown on my Putty. I renamed the file to splunk.tgz, then copied it to the /opt/Splunk/ folder via WinSCP. When I extracted it, It created the splunkforwarder folder and all underlying files/folders.

ktfs01-2# tar xvzf splunk.tgz
x splunkforwarder/
x splunkforwarder/etc/
x splunkforwarder/etc/deployment-apps/
x splunkforwarder/etc/deployment-apps/README............................etc.

ktfs01-2# cd /opt/Splunk/splunkforwarder/bin
ktfs01-2# ./splunk start
ELF binary type "0" not known.
zsh: exec format error: ./splunk
ktfs01-2#

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...