Hi Jorob I saw this option as well. But what if we don't want to run the Splunk daemon in /etc/init.d? I mean, the problem should be well known by Splunk and since allmost a year we don't hear any improvements from them. I'm a little disappointed on Splunk's part that they don't describe a workaround in the docs or even look for the solution. It looks like nobody at Splunk cares about this problem. As I mentioned, I think it's a bad idea to have to install all universal forwarders in the “old” way just because Splunk Stream can't handle it. We are all eagerly awaiting Splunk's response. Greetings   ... View more

Since Splunk 6.x is not more available, the new URL's are: Forwarder Manual: https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Installanixuniversalforwarder..  Installation on MacOS: https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/InstallonMacOS  ... View more

Hi Splunkers I notice the same issue and wonder really why Splunk is not fixing this issue? Is seems to be an incompatibility on the VMware stack with the streamfwd service.  I use Splunk Universalforwarder 9.1.2 and Splunk Stream 9.1.1. Specially the installation on Universalforwarders fails massively on Linux systems which makes Splunk Stream not really usable in a distributed environment with Linux systems. My streamfwd.log tells always the same error:   2024-03-08 14:59:54 INFO [139974317471680] (CaptureServer.cpp:2001) stream.CaptureServer - Starting data capture 2024-03-08 14:59:54 INFO [139974317471680] (SnifferReactor/SnifferReactor.cpp:161) stream.SnifferReactor - Starting network capture: sniffer 2024-03-08 14:59:54 ERROR [139974317471680] (SnifferReactor/PcapNetworkCapture.cpp:238) stream.NetworkCapture - SnifferReactor unrecognized link layer for device <eth0>: 253 2024-03-08 14:59:54 FATAL [139974317471680] (CaptureServer.cpp:2337) stream.CaptureServer - SnifferReactor was unable to start packet capturesniffer 2024-03-08 14:59:54 INFO [139974317471680] (CaptureServer.cpp:2362) stream.CaptureServer - Done pinging stream senders (config was updated) 2024-03-08 14:59:54 INFO [139974317471680] (main.cpp:1109) stream.main - streamfwd has started successfully (version 8.1.1 build afdcef4b) 2024-03-08 14:59:54 INFO [139974317471680] (main.cpp:1111) stream.main - web interface listening on port 8889       As you all can see, my streamfwd.conf is more or less the same as all of you have also. No matter if for example i change the ipAddr to 0.0.0.0. I always get the same error.     [streamfwd] logConfig = streamfwdlog.conf port = 8889 ipAddr = 127.0.0.1 ## --> Token HFWD httpEventCollectorToken = ba4a2b2-2544-55e3-22ft-234vt68m0szp ## --> Specify the interface streamfwdcapture.1.interface = eth0       Side remark: If I reinstall Splunk Enterprise 9.1.2 on the same server on which UniversalForwarder 9.1.2 with Splunk Stream 9.1.1 was installed, Splunk Stream works. That sounds like a bug in Splunk_TA_stream. Would be great to hear a statement of Splunk within the next weeks. Kind regards Patrick   ... View more

I agree, but in some cases it makes sense to give a single user the ability to upload logs to a dedicated index (eg. siem detection usecases). I had to give Admin rights to the server, and that was not the way I wanted to set the permissions. Kind Regards Patrick ... View more

Hi, I tried to add the capabilities listed above, but the user get still the same answer back as before: User is not allowed to modify the job ... View more

Hi I register the same Error Message on other TA's. It seems to be a problem in Python.  ... View more