I need to configured Splunk (running on RHEL6) to work behind a proxy, I tried the recommended approach and it didn't work. On each I restarted Splunk, also note yum-cron/updates works fine. To get around this problem, you need to set the http_proxy environment variable. For permanent results, you can specify the setting in the splunk-launch.conf configuration file, located in $SPLUNK_HOME/etc/ on *nix systems and %SPLUNK_HOME%\etc\ on Windows. In splunk-launch.conf, add this attribute/value pair: http_proxy = : For example: http_proxy = 10.1.8.11:8787 I then tried this: added to opt/splunk/etc/system/default/prefs.conf proxy=http://proxy.local:80/ proxy_username=xxxx proxy_password=xxxxx Questions 1) On Linux, which is the correct file to add the proxy settings? I have seen atleast 3 files mentioned, being: splunk-launch.conf prefs.configuration editing the /etc/init.d/splunk startup script 2) Does the proxy environment variable follow a typical Linux format? For example, are these valid? proxy=http://proxy.local:80/ proxy_username=a_user proxy_password=a_password or Acquire::http::proxy "http://a_user:a_password@proxy.local:80/"; What is the correct why to achieve access from behind a proxy? ... View more

Splunk v4.3.2 *NIX 4.5 About the Splunk Technology Add-on (TA) for Unix and Linux Complete newb with Splunk. Overview Running demo of Splunk on Linux CentOS 6.2 - 64-bit VM Linux guest (CentOS 6.2-64bit) feeding data into Splunk using the Universal Forwarder - splunk-4.3.3-128297-linux-2.6-x86_64.rpm Splunk indexer/receiver configured as below: Data input type TCP > 514 Source > Accept connections from all hosts? Yes Source Type > Manual Source Type > syslog This work just as expected, great! I then tried out the Splunk Technology Add-on (TA) for Unix and Linux, as it would be nice to have performance metrics of various hosts in Splunk, and this is where I'm having problems. I have downloaded *NIX 4.5 to Splunk and it is installed and it is available from the WebGUI under App > *NIX 4.5, and has an enabled status under Manager > Apps I can collect and see performance data from the local host , the Splunk indexer/receiver, but not from the host I configured below. I downloaded the Splunk Technology Add-on (TA) for Unix and Linux to VM Linux guest, taking note that it has to be installed manually, I used this guide, section "Install the TA on a universal forwarder" http://docs.splunk.com/Documentation/UnixApp/latest/User/InstalltheSplunkTechnicalAddonforUnixandLinux - which I followed. I also noted the comments about various typos in the howto. I also noted that for Step 1 under section "Enable data and scripted inputs in the TA", it advises you to copy inputs.conf to a directory named "local', well on my install there is no directory named "local" Quote: "1. Make a copy of $SPLUNK_HOME/etc/apps/Splunk_TA_nix/default/inputs.conf and place it into $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local. " So I had to create the directory and then assign splunk as owner and group perms, not sure this is a documentation error or a sign of trouble. I then followed the rest of the guide, setting all of the disabled attributes to 0, thus enabling all the monitors, and restarted Splunk, it restarted without errors. I got back to my Splunk receiver/indexer, using the Splunk WebGUI I select App > *NIX 4.5, expecting see my host added to it, but it is not, it still has only the local host. What have I missed? ... View more