Hi, Windows query
I have a non AD Windows server 2008R2 setup x 3 servers. Simple setup for 2 servers to send data to Splunk server on 3rd server.
"Splunk" server with latest version of Splunk installed using Splunk web userid "admin", receiver port setup for default 9997
Second server where I have run splunkforwarder5.02....msi and at no stage am I prompted for user id or password. Selected all options however no certificate info. When testing to see status of forwarder (after restarting both Splunk and forwarder server) I get asked for a userid: and password:. Is this the Splunk web userid? - have tried this and fails, also tried the local admin userid - fails.
Firewalls on both disabled - am getting prompted for userid however I am not sure where this challenge is being generated.
Any ideas please?
Thanks
Splunk is asking you to login as you're performing an action that requires you to be authenticated. The passwords on one instance are completely independent one another, and the default credentials will always be an l/p of admin/changeme.
Splunk is asking you to login as you're performing an action that requires you to be authenticated. The passwords on one instance are completely independent one another, and the default credentials will always be an l/p of admin/changeme.
Excellent - when entering default credentials
C:\Program Files\SplunkUniversalForwarder\bin>splunk list forward-server
Splunk username: admin / Password:
Active forwards: None
Configured but inactive forwards: splunk.xxx.com:9997
Nothing further was done but some head scratching and coffee drinking, checked again and voila!
Active forwards: splunk.xxx.com:9997
Configured but inactive forwards: None
Now to see if this can be replicated smoothly on my third server!