OK, I think I found my error. I simply created the "C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_UF_Config" directory, but did not create the "default" or "local" directories under that. I simply placed the "inputs.conf" and "outputs.conf" files under that main directory. But, after I created the "default" and "local" sub-directories, and put the "inputs.conf" and "output.conf" files in the "C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_UF_Config\local" directory, no errors. Thanks for everyone's responses on this issue. ... View more

Santiago, Thanks for the direction but I'm having a little problem. I created a new directory on the Windows UF, "C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_UF_Config". I then moved the inputs.conf and outputs.conf files from the "C:\Program Files\SplunkUniversalForwarder\etc\system\local" directory to the new one. I then tried to start the forwarder and while monitoring the splunkd.log file, saw this ERROR; 10-19-2015 09:55:24.481 -0600 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. I then moved everything back, and the service started with no errors. Any ideas on what I'm doing wrong? ... View more

This seemed to work. I commented out the "host =" and "serverName =" lines in the "inputs.conf" and "server.conf" files respectively and the Forwarder serrvice did start this time and it was named correctly in the Deployment server when it "Phoned Home". But I noticed that the "inputs.conf" and "server.conf" files were not updated. I assume the Splunk Forwarder is looking someplace else for the default server name. Anyway, thanks. ... View more

I just noticed that in the same directory, in the server.conf file, I have the following stanza; [general] pass4SymmKey = <Pass key number> serverName = <actual host name> I'm going to have to change that also. But to what? ... View more

Hexx, Thanks for the quick reply. This explains everything I questions about. I think I'll just uninstall S.o.S an use Distributed Management Console, and hope I get access to some of the remote servers I need to add the Splunk forwarder to soon. ~Ed ... View more

Hexx, Hey thanks for the explanation. But your answer creates 3 more questions from me: 1, If I manually create the CSV file with the headers, will whatever process that created it in the first place overwrite it again? Or was the process that creates it a one-time run? I can't imagine it's a one-time run because the the follow-up question would be what about updates? What happens when forwarders are added or deleted? I still don't have any forwarders established yet so I know that's going to change the status of this issue. If I add nothing to the file manually, will the warnings go away when I finally do add some forwarders? Will the issue clear itself? Now I noticed that when I shut down S.o.S and started to work with Management Console, I saw similar warnings. Are these two applications related somehow? It appears that the Splunk Management Console offers similar data to S.o.S. Is MC a replacement app? ~Ed ... View more

Now I'm getting the same thing when I tried to use the Management Console. The warning shows up every second and I can't turn it off: 10-12-2015 16:49:26.002 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:27.002 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:28.002 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:29.002 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:30.003 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:31.002 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:32.001 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:33.002 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:34.002 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header 10-12-2015 16:49:34.998 -0400 WARN SearchResults - /opt/app/splunk/etc/apps/splunk_management_console/lookups/dmc_forwarder_assets.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header ... View more

Well yea.., I know that NOOooOOowww... 😉 Seriously, thanks again for pointing me in the right direction. ~Ed ... View more

Malmoore, Thanks for the reply. And just to clarify, I saw your entry in the documentation, but that's what confused me. I was not sure if there was a special tar file specifically for Linux servers. I ended up simply copying the "splunk-add-on-for-microsoft-windows_480.tar.gzip" file onto my deployment server, ran an untar and then loaded that onto my Linux indexers & search head servers. That seemed to work fine. The indexes were created and there were no errors. ~Ed ... View more

Muebel, You are correct. I'm just in the process of setting up this instance so I have no forwarders configured yet. When I looked at the "splunk_forwarders_cache.csv", it was there, but completely empty. I would think that even if this was the case, if the file is created, it would, at least, have the column "headers" by default. Does anyone know what these column headers are for s.o.s? I was thinking that I could create a blank csv file, with the headers, to eliminate this repeating warning. ... View more

Oh heck. thanks for the info. ~Ed ... View more

Adossant, Were you able to figure this one out yet? I believe I'm seeing the same kind of issue with my instance. ~Ed ... View more

Well, I set the "host" attribute in the "inputs.conf" file and the "serverName" in the "server.conf" file for all servers I'm working on to their respective IP address. Only 1 is sending data with the "host" as the IP address. The rest are using the vendor's original hostname that's the same for all. Any idea's on what I forgot to flush out? ... View more

Thanks for these answers. I will try the IP to make things easier to understand in the indexed data. And here are some replies to your answers; That's what I thought. But for some reason I was getting indexed data returned from a search attributed to data from the actual host name and the name I changed it to. That was confusing. I didn't know this. I was thinking that the servername in the server.conf file that was still pointing to the original name, was overriding the "host" attribute that I updated in the inputs.conf file somehow. I'll change the "host" entry to the IP to see if that cleans things up. Things would have been a lot easier if the vendor simply added "01" or whatever to the host names of his appliances to make them unique. But what do I know. 😞 ... View more