Splunk Enterprise

Getting error when trying to active the universal forwarder.

saadzaidi
New Member

Dear Members,

 

I'm new in splunk, i'm trying to forward the RHEL logs to the indexer. i've done all the necessary configuration to forward the logs, but didn't receive on the indexer. When i checked the status forward server, using ./splunk list forward-server command. It was showing inactive. Because of some file ownership. 

Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R splunkfwd:splunkfwd /opt/splunkforwarder"

So, I ran the below command to change the file ownership. 

sudo chown -R splunkfwd:splunkfwd /opt/splunkforwarder.

After executing the above command, still i'm not receiving the logs and moreover, when again i'm trying to run this "./splunk list forward-server" command to check the status of forwarder, it will takes me to enter username and password again, when i'm entering the username and password its showing login failed.

NOTE: I've tried to login using both root and splunk user. But non of this worked.

Please help me out in this, what should i do to make it work.

 

Thank you. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...