Facing Issue with Forwarder version 9.4.0 in sending logs to server

[malimahesh25]

Hi team, 

I am unable to send logs to server by using "splunk add monitor <filename>" command with forwarder version 9.4.0
Splunk is running as root user. add monitor command is asking for credentials. And the inputs.conf file is not getting updated with the log file name that is added to monitor.

sudo splunk add monitor Test.log
Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R root:root /opt/splunkforwarder"
Splunk username:
Password:
Login failed


Tested with forwarder version 9.0.0 and it worked. That time also it asked for credentials but inputs.conf got updated and logs sent to server without providing the credentials.

I want to send logs to server using forwarder 9.4.0

What changes should I do to make it work. Please suggest...

[livehybrid · Accepted solution]

Hi @malimahesh25 

Firstly, I just want to mention that it is generally not advised to run Splunk as root. 

Regarding your issue - the reason that the inputs.conf is not being updated is that the authentication to Splunk failed. Do you know your Splunk credentials for the forwarder? This is the Splunk admin auth user, NOT the system user credentials.

If you do not know the password then you can reset it by following these steps:

Find the passw file for your instance ($SPLUNK_HOME/etc/passwd) and rename it to passwd.bk
Create a file named user-seed.conf in your $SPLUNK_HOME/etc/system/local/ directory.
In the file add the following text:

[user_info]
USERNAME = admin
PASSWORD = NEW_PASSWORD

In the place of "NEW_PASSWORD" insert the password you would like to use.
Restart Splunk

After restarting Splunk you should now be able to run the command, logging in with the new credentials.

For more info see https://docs.splunk.com/Documentation/Splunk/9.4.0/admin/User-seedconf

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[isoutamo]

Another proposal, don’t use cli to add inputs. That install those under SPLUNK_HOME/etc/system/local. If/when you are taking DS into use you must manually move/update those node by node.
You should always use separate apps where you are putting those definitions. That way it’s really easy to update those later on and also add same configuration to other nodes too as every log sources have their own app.