splunk list forward-server

[duncanuno]

Hi, Windows query

I have a non AD Windows server 2008R2 setup x 3 servers. Simple setup for 2 servers to send data to Splunk server on 3rd server.
"Splunk" server with latest version of Splunk installed using Splunk web userid "admin", receiver port setup for default 9997

Second server where I have run splunkforwarder5.02....msi and at no stage am I prompted for user id or password. Selected all options however no certificate info. When testing to see status of forwarder (after restarting both Splunk and forwarder server) I get asked for a userid: and password:. Is this the Splunk web userid? - have tried this and fails, also tried the local admin userid - fails.

Firewalls on both disabled - am getting prompted for userid however I am not sure where this challenge is being generated.

Any ideas please?

Thanks

[jbsplunk · Accepted solution]

Splunk is asking you to login as you're performing an action that requires you to be authenticated. The passwords on one instance are completely independent one another, and the default credentials will always be an l/p of admin/changeme.

[duncanuno]

Excellent - when entering default credentials

C:\Program Files\SplunkUniversalForwarder\bin>splunk list forward-server

Splunk username: admin / Password:

Active forwards: None

Configured but inactive forwards: splunk.xxx.com:9997

Nothing further was done but some head scratching and coffee drinking, checked again and voila!

Active forwards: splunk.xxx.com:9997

Configured but inactive forwards: None

Now to see if this can be replicated smoothly on my third server!