Install the Splunk Add-on for Stream Forwarder

Use the Deployment server to push Splunk Add-on for Stream Forwarder to all of your forwarders. You can also install Splunk Add-on for Stream Forwarder on individual forwarders.

To install a independent Stream Forwarder, see Install the Independent Stream Forwarder.

If you want to upgrade a forwarder to 7.3 or later, see Migrate Splunk Stream in a distributed deployment.

To configure your forwarders, see Configure your Splunk Stream forwarders

Use the deployment server to distribute Splunk Add-on for Stream Forwarders to universal forwarders

1. Go to http://splunkbase.com/app/5238.
2. Click Download. The Splunk_TA_stream_<latest_version>.tgz installation package downloads to your local host.
3. Log into Splunk Web.
4. Click Manage Apps > Install app from file.
5. Upload the Splunk_TA_stream_<latest_version>.tgz installer file.
6. Restart Splunk Enterprise, if prompted. This installs the Splunk_TA_stream in the $SPLUNK_HOME/etc/apps directory. This is a pre-configured copy of Splunk_TA_stream that you can deploy to universal forwarders using the deployment server.
7. Set Splunk_TA_stream permissions: On Linux and OSX, run the set_permissions.sh script in the Splunk_TA_stream directory.

   cd $SPLUNK_HOME/etc/apps/Splunk_TA_stream
   sudo chmod +x ./set_permissions.sh
   sudo ./set_permissions.sh

   On Windows systems, Splunk Stream supports the Admin role only.

To configure your forwarders, see Configure your Splunk Stream forwarders

Manually install the Splunk Add-on for Stream Forwarders on Splunk forwarders

To collect network data from one or more forwarders without using a deployment server, manually install Splunk_TA_stream on each forwarder.

1. Go to http://splunkbase.com/app/5238 and download the latest installation package to $SPLUNK_HOME/etc/apps on the Universal Forwarder
2. Untar the package to $SPLUNK_HOME/etc/apps
3. Verify that Splunk_TA_stream/local/inputs.conf specifies the correct location of splunk_app_stream.

    [streamfwd://streamfwd]
   splunk_stream_app_location = https://localhost:8000/en-us/custom/splunk_app_stream/
   stream_forwarder_id = 
   disabled = 0
   

4. Verify that Splunk_TA_stream/local/streamfwd.conf is configured to collect data from the network interface. By default, streamfwd.conf collects data from all network interfaces.
5. Set Splunk_TA_stream permissions: On Linux and OSX, run the set_permissions.sh script in the Splunk_TA_stream directory.

   cd $SPLUNK_HOME/etc/apps/Splunk_TA_stream
   sudo chmod +x ./set_permissions.sh
   sudo ./set_permissions.sh

6. Restart Splunk Enterprise.