I have installed the forwarder in `/opt/splunkforwarder` and run the `splunk start` command. I get the license to read/accept, but when I accept the license I get the following message:
**This appears to be your first time running this version of Splunk.
Could not open log file "/opt/splunkforwarder/var/log/splunk/first_install.log" for writing (2).**
When I check the splunkforwarder directory, there is no var folder...
Any help would be appreciated.
Dave
↧