Wire Data modular input stops working after upgrade
After manually deleting the application folders without stopping Splunk and then installing or upgrading the app, the Wire Data input stops working. Some of the symptoms are as follows:
1. Wire Data configuration (Splunk App for Stream Location) not present.
2. Wire Data is not present in the data input.
3. Splunk stream forwarder interface does not increment counters.
4. Wire Data configuration is present, but enabling streamfwd from UI has no effect.
For symptoms 1, 2, and 3, a restart of Splunk might fix the issue.
cd $SPLUNK_HOME/bin ./splunk restart
Otherwise, follow this workaround:
1. From CLI, stop Splunk.
cd $SPLUNK_HOME/bin ./splunk stop
2. Go to $SPLUNK_HOME/etc/apps.
4. Start Splunk.
cd $SPLUNK_HOME/bin ./splunk start
5. Go to Splunk Web and install (or reinstall) the Splunk App for Stream application. See Install Splunk App for Stream.
6. Restart Splunk from the UI.
7. Go to Settings > Data inputs.
The Wire Data option should now appear in the UI.
7. Click Enable.
You should now see wire data indexing into Splunk. Follow these same steps for symptom 4 as well.
Note: If you need to delete
Splunk_TA_Stream folders, you should stop Splunk first and then delete the folders. If you do not stop Splunk, then you will encounter the above issues.
This documentation applies to the following versions of Splunk Stream™: 6.1.1