- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Splunk Cloud Forwarder on Linux
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Cloud Forwarder on Linux
Hello,
I am following the guide here : https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/User/ForwardDataToSplunkCloudFromLinux
At some point it sais i need to install splunkclouduf.spl file which i have downloaded from my cloud instance using : splunk install app <full path to splunkclouduf.spl> -auth <username>:<password> . Problem is whenever i try to run that command i get : Not Found . I am 100% sure the path and credentials are correct . What am i missing ? Or is this a step i need or shall i skip it ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure you're in the right directory (bin folder inside your splunk universal forwarder installation folder)? Have your tried ./splunk... instead of just splunk...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes and Yes.
root@host:/home/devuser/splunkforwarder/bin# ./splunk install app ../../splunkclouduf.spl -auth admin:changeme
Not Found
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does the user you run splunk as (non-root I hope) have permissions to access the .spl file?
Do other splunk commands work (e.g. ./splunk status)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
root@host:/home/devuser/splunkforwarder/bin# ./splunk status
splunkd is not running.
I think i got it. I must have messed up something and splunk did not start . I will start from scratch and see what happens . Thanx.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, so the basic thing works, it's specifically that install command that fails. Not sure if splunk needs to be running to perform ./splunk install...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes and Yes.
root@host:/home/devuser/splunkforwarder/bin# ./splunk install app ../../splunkclouduf.spl -auth admin:changeme
Not Found
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
