Getting Data In

Why are outputs.conf not found?

HaakonRuud
Explorer

I've made an app and put the app in "$Splunk_Home\etc\apps\app_name\local" where I have the outputs.conf file. Since there is no outputs.conf file in "$Splunk_Home\etc\system\local" I get an error message in the log stating: "LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf".  If I move the outputs.conf file from my app to "$Splunk_Home\etc\system\local" it will work. I've have already an old setup that I inherited where this is working. It seems like the file in my app is not read for some reason. I've checked that the user have read access to files in my app. Unfortunatly I don't have documentation from the old setup so I can't see how this was implemented. Are someone able to point me in the right direction? I've tried searching for this issue, but couldn't find anything related to this issue. Thanks in advance

Labels (1)
0 Karma

HaakonRuud
Explorer

I've checked that there is only outputs.conf files in $Splunk_Home\etc\apps\SplunkUniversalForwarder\default, $Splunk_Home\ets\system\default and in $Splunk_Home\etc\apps\app_name\local

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

just try to run

splunk btool outputs list —debug

to see where splunk found that file and what  parameters it get for it. 

r. Ismo

0 Karma

HaakonRuud
Explorer

Hi

After running "splunk btool outputs list --debug" it finds all the outputs.conf files except the one that's in the app I created. I've checked the folder and files and it has exactly the same read permitions as the $Splunk_Home\etc\system folder. Do you have any sugestions what this means? Thank you so far!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @HaakonRuud,

at first $Splunk_Home\etc\apps\SplunkUniversalForwarder\default, isn't relevant: this is an internal app to not use.

Anyway, outputs.conf must be located in $SPLUNK_HOME\etc\system\local or in $SPLUNK_HOME\etc\apps\your_app\local.

The approach to put outputs.conf in a dedicated app is a best practice that I always use, so it must run.

If not, check if the user used to run Splunk has the rights to read this file.

then, please share it, maybe there's an erro so it isn't read by Splunk.

And always remember to restart Forwarder.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...