I'm on host "capture", stream server is "streamserver"
Downloaded stream from web interface.
While starting stream I get.
2020-11-03 15:20:00 INFO [140374280497024] (main.cpp:1120) stream.main - streamfwd has started successfully (version 7.1.3 build 35)
2020-11-03 15:20:00 INFO [140374280497024] (main.cpp:1122) stream.main - web interface listening on port 8889
2020-11-03 15:20:05 ERROR [140374279440128] (CaptureServer.cpp:2210) stream.CaptureServer - Unable to ping server (a3b2ebe6-9466-4e36-8119-2c8ff3151d4b): /en-US/custom/splunk_app_stream/ping/ status=401
2020-11-03 15:20:10 ERROR [140374022964992] (CaptureServer.cpp:2210) stream.CaptureServer - Unable to ping server (a3b2ebe6-9466-4e36-8119-2c8ff3151d4b): /en-US/custom/splunk_app_stream/ping/ status=401
2020-11-03 15:20:11 ERROR [140374022964992] (CaptureServer.cpp:2298) stream.CaptureServer - /en-US/custom/splunk_app_stream/indexers?streamForwarderId=xxx status=401
/opt/splunkforwarder/etc/apps/Splunk_TA_stream/local/streamfwd.conf
[streamfwd]
port = 8889
ipAddr = 127.0.0.1
netflowReceiver.0.ip = xxxx
netflowReceiver.0.port = 9996
netflowReceiver.0.decoder = netflow
netflowReceiver.0.protocol = udp
cat /opt/streamfwd/local/streamfwd.conf
[streamfwd]
httpEventCollectorToken = xxxx
netflowReceiver.0.port = 9996
netflowReceiver.0.protocol = udp
netflowReceiver.0.ip = xxxx
netflowReceiver.0.decoder = netflow
cat /opt/streamfwd/local/inputs.conf
[streamfwd://streamfwd]
splunk_stream_app_location = https://streamserver:8000/en-US/custom/splunk_app_stream/
stream_forwarder_id = infra_netflow
cat /opt/splunkforwarder/etc/apps/Splunk_TA_stream/local/inputs.conf
[streamfwd://streamfwd]
splunk_stream_app_location = https://streamserver:8000/en-US/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0
index = netflow
curl -k "https://streamserver:8000/en-us/custom/splunk_app_stream/ping/"
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Unauthorized</msg>
</messages>
</response>
