All Apps and Add-ons

Splunk Stream: Why is streamfwd failing to start on Linux?

sloshburch
Splunk Employee
Splunk Employee

streamfwd is working well on my Windows machines but not on my Amazon Linux AMI instances. Only using the 'defaultgroup' for Distributed Forwarder Management within Splunk Stream App UI. Pushing out the Stream TA with the Deployment Server.

Splunk is not running on root so I followed these instructions while logged in as the splunk process owner: http://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/InstallSplunkAppforStream#Set_...

Seeing stuff like this in streamfwd.log (nothing catching my eye in splunkd.log): FATAL [139868534323072] (main.cpp:1149) stream.main - Failed to start streamfwd, the process will be terminated: No <stanza> found in <configuration>

I've also tried setting streamfwd.conf as follows to capture all interfaces:

[streamfwd]
    streamfwdcapture.0.interfaceRegex = .*

Anyone experienced this or have expertise on this? Thanks ahead of time!

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

So embarrassing but I forgot to put disabled = false in the inputs. Obviously changing that fixed this...

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

So embarrassing but I forgot to put disabled = false in the inputs. Obviously changing that fixed this...

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

do you have the inputs.conf configured for the Stream TA?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I do! Sorry for not being clear on that, but I thought it was implied by the fact that I am in fact getting data from the Windows machines, just not the Linux ones.

In case it helps, here's what I'm rocking so far:

[streamfwd://streamfwd]
splunk_stream_app_location = https://awesomeurlhere:coolport/en-us/custom/splunk_app_stream/
stream_forwarder_id = 
index = cool_index_here
0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

Sorry got sidetracked. Seems like it would be easier to troubleshoot this issue over webex. Please ping me directly or in the Stream hipchat room.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...