splunkclouduf.spl failed login

[tthonest]

Receiving this error below...

C:\Program Files\SplunkUniversalForwarder\bin>splunk install app splunkclouduf.spl -auth admin:changeme
Login failed

documentation states forwarders and indexers have the same credentials and admin:changeme is the default. I haven't changed anything but since my indexers are on splunkcloud not managed by us, do we need to contact support??

[woodcock · Accepted solution]

Clearly you do not have the correct password but who cares? Just do this:

1: Rename splunkclouduf.spl to splunkcloud.tgz
2: Unzip the TGZ to get the app.
3: Place this app in C:\Program Files\SplunkUniversalForwarder\apps\
4: Restart the UF (which does not require the PW).

[richgalloway]

Are you certain of the forwarder's credentials? You would have selected a password when you installed it.