All Apps and Add-ons

Splunk App for Stream. deploying onto Windows

realgandy
Explorer

Hi

Pretty new to Splunk and trying to get to grips with deployment of apps.

I have a deployment server running on Linux and am trying to deploy the splunk app for stream out to a windows server, running universal forwarder, to capture wire data on the windows server.

The deployment appears to work as I get the relevant splunk_TA_stream directory created under apps.

I've looked at all the documentation a hundred times and checked all config files and they appear to contain all the right info, yet no wire capture ever happens.

Has anyone actually got this to work, and if so are you able to offer some direction for me?

Many thanks
Gary

Tags (1)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

You don't mention installing winpcap on the endpoints. Winpcap is the underlying packet sniffer that Splunk App for Stream relies on to actually capture packets. You can't install winpcap through Splunk, so it's got to be deployed manually or via some other Windows-y method, like SCCM.

If you don't have that, please install it, restart everything involved and see if it doesn't help. For what its worth, it's a tiny, fast, and non-invasive install.

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

You don't mention installing winpcap on the endpoints. Winpcap is the underlying packet sniffer that Splunk App for Stream relies on to actually capture packets. You can't install winpcap through Splunk, so it's got to be deployed manually or via some other Windows-y method, like SCCM.

If you don't have that, please install it, restart everything involved and see if it doesn't help. For what its worth, it's a tiny, fast, and non-invasive install.

0 Karma

realgandy
Explorer

Thanks.

That wasn't the only issue though (not seen that pre-req in any document, maybe I just missed it)... The streamfwd logfile location was a bit screwed in the log4j config file. Corrected that in the local version and now all is working.

Many Thanks for your help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...