Since Splunk 6.x is not more available, the new URL's are: Forwarder Manual: https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Installanixuniversalforwarder..  Installation on MacOS: https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/InstallonMacOS  ... View more

Hi Splunkers I notice the same issue and wonder really why Splunk is not fixing this issue? Is seems to be an incompatibility on the VMware stack with the streamfwd service.  I use Splunk Universalforwarder 9.1.2 and Splunk Stream 9.1.1. Specially the installation on Universalforwarders fails massively on Linux systems which makes Splunk Stream not really usable in a distributed environment with Linux systems. My streamfwd.log tells always the same error:   2024-03-08 14:59:54 INFO [139974317471680] (CaptureServer.cpp:2001) stream.CaptureServer - Starting data capture 2024-03-08 14:59:54 INFO [139974317471680] (SnifferReactor/SnifferReactor.cpp:161) stream.SnifferReactor - Starting network capture: sniffer 2024-03-08 14:59:54 ERROR [139974317471680] (SnifferReactor/PcapNetworkCapture.cpp:238) stream.NetworkCapture - SnifferReactor unrecognized link layer for device <eth0>: 253 2024-03-08 14:59:54 FATAL [139974317471680] (CaptureServer.cpp:2337) stream.CaptureServer - SnifferReactor was unable to start packet capturesniffer 2024-03-08 14:59:54 INFO [139974317471680] (CaptureServer.cpp:2362) stream.CaptureServer - Done pinging stream senders (config was updated) 2024-03-08 14:59:54 INFO [139974317471680] (main.cpp:1109) stream.main - streamfwd has started successfully (version 8.1.1 build afdcef4b) 2024-03-08 14:59:54 INFO [139974317471680] (main.cpp:1111) stream.main - web interface listening on port 8889       As you all can see, my streamfwd.conf is more or less the same as all of you have also. No matter if for example i change the ipAddr to 0.0.0.0. I always get the same error.     [streamfwd] logConfig = streamfwdlog.conf port = 8889 ipAddr = 127.0.0.1 ## --> Token HFWD httpEventCollectorToken = ba4a2b2-2544-55e3-22ft-234vt68m0szp ## --> Specify the interface streamfwdcapture.1.interface = eth0       Side remark: If I reinstall Splunk Enterprise 9.1.2 on the same server on which UniversalForwarder 9.1.2 with Splunk Stream 9.1.1 was installed, Splunk Stream works. That sounds like a bug in Splunk_TA_stream. Would be great to hear a statement of Splunk within the next weeks. Kind regards Patrick   ... View more

I agree, but in some cases it makes sense to give a single user the ability to upload logs to a dedicated index (eg. siem detection usecases). I had to give Admin rights to the server, and that was not the way I wanted to set the permissions. Kind Regards Patrick ... View more

Hi, I tried to add the capabilities listed above, but the user get still the same answer back as before: User is not allowed to modify the job ... View more

Hi I register the same Error Message on other TA's. It seems to be a problem in Python.  ... View more