What do you mean "the .tgz installer." any links to that or a guide please? i did the chown -R with user splunk and boot-enable I see in the logs : 11-23-2020 09:27:13.491 +0000 INFO ScheduledViewsReaper - Scheduled views reaper run complete. Reaped count=0 scheduled views 11-23-2020 09:27:13.491 +0000 INFO CascadingReplicationManager - Using value for property max_replication_threads=2. 11-23-2020 09:27:13.491 +0000 INFO CascadingReplicationManager - Using value for property max_replication_jobs=5. 11-23-2020 09:27:13.514 +0000 INFO TcpOutputProc - Removing quarantine from idx=X.X.X.X:9997 11-23-2020 09:27:13.514 +0000 WARN TcpOutputFd - Connect to X.X.X.X:9997 failed. No route to host 11-23-2020 09:27:13.514 +0000 ERROR TcpOutputFd - Connection to host=X.X.X.X:9997 failed 11-23-2020 09:27:13.515 +0000 WARN TcpOutputFd - Connect to X.X.X.X:9997 failed. No route to host 11-23-2020 09:27:13.515 +0000 ERROR TcpOutputFd - Connection to host=X.X.X.X:9997 failed 11-23-2020 09:27:13.515 +0000 WARN TcpOutputProc - Applying quarantine to ip=X.X.X.X port=9997 _numberOfFailures=2 I cant make it start and FW is ok. we have checked i think i, installing it wrong and all guides are the same.. i need some guide. also i don't know how to open a ticket. ============================== Full seconds iinstall from tgz same results: tar xvzf splunkforwarder-8.1.0-f57c09e87251-Linux-x86_64.tgz -C /opt chown -R splunk:splunk /opt/splunkforwarder/ /opt/splunkforwarder/bin/splunk enable boot-start -systemd-managed 0 --accept-license --answer-yes --no-prompt --seed-passwd XXX ./splunk start Splunk> Australian for grep. Checking prerequisites... Checking mgmt port [8089]: open Creating: /opt/splunkforwarder/var/lib/splunk Creating: /opt/splunkforwarder/var/run/splunk Creating: /opt/splunkforwarder/var/run/splunk/appserver/i18n Creating: /opt/splunkforwarder/var/run/splunk/appserver/modules/static/css Creating: /opt/splunkforwarder/var/run/splunk/upload Creating: /opt/splunkforwarder/var/run/splunk/search_telemetry Creating: /opt/splunkforwarder/var/spool/splunk Creating: /opt/splunkforwarder/var/spool/dirmoncache Creating: /opt/splunkforwarder/var/lib/splunk/authDb Creating: /opt/splunkforwarder/var/lib/splunk/hashDb New certs have been generated in '/opt/splunkforwarder/etc/auth'. Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunkforwarder/splunkforwarder-8.1.0-f57c09e87251-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Same error with logs: 11-23-2020 10:24:40.031 +0000 WARN TcpOutputFd - Connect toX.X.X.X10:9997 failed. No route to host
... View more
