Deploy Independent Stream Forwarder
Splunk App for Stream supports Independent Stream Forwarder (streamfwd
) installation on compatible Linux machines. To facilitate independent Stream Forwarder installation, Splunk App for Stream generates a curl
script that automatically installs Stream Forwarder for you.
Independent Stream Forwarder deployment is useful, for example, for capturing network data from Linux hosts that you want to monitor as part of a network service in a Splunk IT Service Intelligence (ITSI) deployment.
Prerequisites
- 64-bit Linux (RHEL and Ubuntu) only.
- An existing Splunk App for Stream 6.5.0 or later deployment. (Independent
streamfwd
receives stream configurations from the existingsplunk_app_stream
installation.) - You must configure HTTP event collector (HEC) on indexers to receive data from independent Stream forwarder.
Independent Stream forwarder does not require Universal Forwarder.
Install independent Stream forwarder using curl
- Go to Configure > Distributed Forwarder Management.
- Click Install Stream Forwarder. The Install Stream forwarder window appears.
- Copy the curl script.
- SSH into the Linux machine where you want to install Stream forwarder.
- Run the curl script that you copied from Splunk App for Stream. For example:
curl -sSL http://stream-cont-func02:8000/en-us/custom/splunk_app_stream/install_streamfwd | sudo bash
- Enter [yes] at each prompt to download, install, and start the
streamfwd
binary.
After the independent Stream forwarder installation is complete, confirm that the splunk_stream_app_location
address is set correctly in /opt/streamfwd/local/inputs.conf
.
Enable SSL certificate validation
You can enable certificate validation for SSL connections to streamfwd
to verify the identity of splunk_app_stream
servers. For more information, see Enable TLS certificate validation in this manual.
Enable HTTP Event Collector to send data to indexers
To send data from an independent Stream Forwarder to indexers, HTTP Event Collector must be enabled on the indexer instance(s). HTTP Event Collector is supported for Independent Stream Forwarder only.
- In Splunk App for Stream, go to Configuration > Distributed Forwarder Management.
- Click Install Stream Forwarders. If the HTTP Event Collector streamfwd token configuration is disabled, click View Configuration. The HTTP event collector page opens.
- Click Global Settings.
- In the Edit Global Setting modal, click Enabled. This enables the HTTP event collector.
- Click Save.
- Make sure "streamfwd" HTTP Event Collector input is present and enabled.
Propagate HTTP Event Collector configuration to indexer cluster
HTTP Event Collector must be enabled and have the identical configuration for [httpː//streamfwd
input as well as collector's SSL configuration on all indexers to which Stream Forwarders are sending events. However, Splunk App for Stream can only generate the streamfwd HTTP Event Collector input on the instance on which it is running,
For this reason, if you want to send data to an indexer cluster, you must copy the [httpː//streamfwd]
stanza from $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf
on the appropriately configured instance, to the corresponding splunk_httpinput/local/inputs.conf
files on all indexers.
For example:
[http://streamfwd] disabled = 0 token = 521F51A6-093C-4954-80F9-47A5445DFBDD
For more information on HTTP Event Collector, see Use HTTP Event Collector in Getting Data In.
Install Splunk App for Stream | Deploy Splunk App for Stream on a search head cluster |
This documentation applies to the following versions of Splunk Stream™: 6.5.0, 6.5.1
Feedback submitted, thanks!