Hi bkumarm,
As of Stream 6.4.2, you'll need the following layout...
splunk_app_stream : deployed to a single search head, this is your primary configuration point for Stream, as well as viewing the dashboards.
Splunk_TA_stream: needs to be deployed to any splunk instance that will perform searching, parsing, or local data capturing. In your scenario, this means the search head, forwarders and indexers. On the search head and indexers, if you do NOT want to have local capture, then make sure the copy they get have disabled=1 in their inputs.conf.
On the systems actually performing data capture (the forwarders), if they are Linux, you'll have one additional step, which is to allow the streamfwd process the ability to perform network capture. The docs list that out here: http://docs.splunk.com/Documentation/StreamApp/6.4.2/DeployStreamApp/InstallSplunkAppforStream#Step_3:_Ensure_Proper_Permissions
One last thing, out of the box, the TA understands certain network interface naming conventions. If you're on Linux, that defaults to eth# and en#. If you happen to use a different naming convention, you'll need to make a copy of Splunk_TA_stream/default/streamfwd.xml into Splunk_TA_stream/local/streamfwd.xml and make it look similar to this (assuming your interface is of the form enp#s#):
<CmConfig xmlns="http://purl.org/cloudmeter/config" version="6.4.2">
<Port>8889</Port>
<UIDirectory>../ui</UIDirectory>
<DataDirectory>../data</DataDirectory>
<LogConfig>streamfwdlog.conf</LogConfig>
<Capture>
<InterfaceRegex>enp[0-9]s[0-9]</InterfaceRegex>
</Capture>
</CmConfig>
For Windows, you'll want to specify the network alias, such as "Local Area Network", or whatever your naming convention happens to be.
You'll need to restart the splunk instance after making any of these changes.
Hope that helps,
-js
... View more
