I use Universal Forwarder (UF) and try to configure it using DeploymentServer located on det index server. The application/config meant to be placed on the UF is not found on the UF. During startup of the UF the following is written in the splunkd.log;
...
05-30-2011 15:25:08.540 +0200 ERROR IndexProcessor - 'blockSignatureDatabase' tag required in config
05-30-2011 15:25:08.560 +0200 ERROR IndexProcessor - Index configuration error: 'blockSignatureDatabase' tag required in config
05-30-2011 15:25:08.573 +0200 WARN HttpPubSubConnection - Received message for an unsubscribed channel: deploymentServer/phoneHome/default/reply/[* server name - masked out ** ]/deploymentClient
05-30-2011 15:25:08.575 +0200 ERROR pipeline - Index configuration error: 'blockSignatureDatabase' tag required in config
05-30-2011 15:25:08.575 +0200 ERROR PipelineComponent - The pipeline indexerPipe threw an exception during initialize
05-30-2011 15:25:08.575 +0200 INFO PipelineComponent - Shutting down system due to fatal error
...*
Note that on the same server as the UF is running it is also running an old LightForwarder in parallell on a different management port. This is done because we are setting up a new Splunk environment and want to keep the old as it is with an overlap of data.
Anyone who can help me understand what this mean and how I can solve this?
... View more
