Hi,
I installed the Splunk forwarder on OSX 10.9.1 and started the app, which too me to a web page localhost:8000 which failed to load any thing in the browser. I have trawled the splunk docs to find the manual process and run the following command as root
/Applications/Splunk/bin/splunk add forward-server [Splunk server]:9997
When it asks for the splunk username and password I put in the login for my Splunk server, which is working fine and has 2 PC splunk forwarders connected, but I get a "login failed" response.
Should I just install the full Splunk install and create a forwarder in that.
We have an enterprise license.
Thanks in advance
The credentials are for the local Splunk forwarder, not your Splunk server. If you didn't change these the default values are "admin" with the password "changeme".
Awesome thanks!