Splunk Enterprise

raspberry installation

lironalter
Loves-to-Learn

trying to forward logs from node process that runs on a raspberry pi model 3b

the error i get when i try ti run the splunk universal forwarder on my pi

lironalter_0-1625379598779.png

running the file command on the splunk executable returns this result:

lironalter_0-1625379884503.png

 

of course i downloaded the arm version of the universal forwarder.

any help will be much appreciated 

rpi specs:

lironalter_0-1625380865483.png

os details:

lironalter_0-1625381243811.png

 

Labels (1)
0 Karma

codebuilder
Influencer

First thing I notice is that you aren't passing in any arguments. Simply running the splunk binary won't have any effect. If you're trying to start it up for the first time try using:


$SPLUNK_HOME/bin/splunk start

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

lironalter
Loves-to-Learn

Thanks for answering! 

Obviously it returns the same error since the error is that the file can't even be execute...

Here is an example:

lironalter_0-1625639829723.png

 

0 Karma

codebuilder
Influencer

Try adding execute permissions to the binary:

chmod +x $SPLUNK_HOME/bin/splunk

Also, who owns it? If it's owned by root be sure you are using sudo or log in as the root user.

sudo $SPLUNK_HOME/bin/splunk start

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

lironalter
Loves-to-Learn

Really appreciate your helping!

As I said before as I suspect the issue here is that the OS cannot execute the file at all.

Tried you suggestion and got the same error, the file permissions are:

-r-xr-xr-x

 so no issue there.

Any other ideas? thanks again!

 

 

0 Karma

codebuilder
Influencer

Who owns the binary? It looks like you have it installed at /home/pi so you'll need to either run it as root or as the "pi" user. Any user other than root or "pi" won't be able to execute it.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
Influencer

You might also check the reply by @hsesterhenn_spl on this topic:

https://community.splunk.com/t5/Splunk-Enterprise/Splunk-on-ARM-Achitecture/m-p/512005

 

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!