deployment-server question

[fisk12]

in this manual http://www.splunk.com/base/Documentation/latest/Deploy/Extendedexampledeployseveralstandardforwarder...

they say that i should run this command as part of configuration.

./splunk enable listen 9997 -auth :

when i do it on the machine that is supposed to work as a deployment server i get this error

./splunk enable listen 9997 -auth :

Command error: The subcommand 'listen' is not valid for command 'enable'.

[Steve_G_]

Forwarders send data to receivers, which are usually indexers. The "enable listen" command is the command that you run on the receiver, not the forwarder. It allows the receiver to listen for data coming from a forwarder.

How you set up a deployment server to communicate with deployment clients is a separate issue, which is convered in the earlier steps in that example.

For more information on forwarding and receiving, refer to:

http://www.splunk.com/base/Documentation/latest/Deploy/Aboutforwardingandreceivingdata

[fisk12]

Splunk Universal Forwarder 4.2.1 (build 98164)

Am i supposed to run the command on the deployer-server or the client?

[jkerai]

It should be run on the indexer that will listen and receive data from from universal forwarder on port 9997. I am assuming that your indexer will serve the purpose of Deployment Server as well. If so, you can run the command on DeploymentServer/indexer.

[jkerai]

Could you provide the output of following command 'splunk version'. Can you check if you are running the command on indexer or Universal forwarder?