I have streamfwd "running" on OSX
I see the following errors in the Splunk interface when I run the search
index=_internal sourcetype="stream:log"
SnifferReactor failed to open pcap adapter for device <en1>. Error message:
Unable to ping server (591fb575-3b32-421a-956f-2f3b512ecda9): Unable to establish connection to localhost: Connection refused
Splunk is running as a privileged user (started splunk using sudo) and setuid.sh has been run in Splunk_TA_stream directory.
any ideas?
Are you planning to capture the en1 interface or is it just getting picked up by default configuration? Stream Forwarder by default starts captures on all en* and lo* interfaces. There's a known issue (will be fixed in the next version) with starting stream forwarder if starting the data capture on one of these interfaces fails. As a workaround, you can specify the actual interface you want to capture the data by using the config parameter in streamfwd.xml config file - http://docs.splunk.com/Documentation/StreamApp/6.3.2/DeployStreamApp/ConfigureStreamForwarder#Use_XM...
Hello,
I've the same issue, i'm running the 7.0.1 and i've specified one interface but i still get the error 😕
Any ideas ?
Regards !
Do you have sufficient permissions? On Mac/linux, you need to run set_permissions.sh
script as sudo before starting stream forwarder.
Are you planning to capture the en1 interface or is it just getting picked up by default configuration? Stream Forwarder by default starts captures on all en* and lo* interfaces. There's a known issue (will be fixed in the next version) with starting stream forwarder if starting the data capture on one of these interfaces fails. As a workaround, you can specify the actual interface you want to capture the data by using the config parameter in streamfwd.xml config file - http://docs.splunk.com/Documentation/StreamApp/6.3.2/DeployStreamApp/ConfigureStreamForwarder#Use_XM...
I meant now collecting data 🙂
great thanks.
no collecting data.