I want to be able to install the jmx_ta app on a Universalforwarder. I've read a lot of questions on here and the default answer seems to be "Install a python runtime and it "should" work. It doesn't. As soon as I provide a python runtime for splunk, when restarting the process, I get the following error...
$ sudo /opt/splunkforwarder/bin/splunk start
Checking prerequisites...
Checking mgmt port [8089]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes... Problem parsing indexes.conf: stanza=default Required parameter=blockSignatureDatabase not configured.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
Before adding the runtime, it would never ( visibly ) check the 'critical directories' and the 'indexes'. I don't intend on doing any indexing on this server at all. I just want to foward the raw data to the search head.
I would also like to point out that I have this working on a test box using a FULL install of Splunk. I need to get it working on the UniversalForwarder. Any ideas? Thanks