{
  stdenv,
  lib,
  fetchurl,
  #, alsa-lib
  openssl,
  zlib,
  autoPatchelfHook,
}:
stdenv.mkDerivation rec {
  pname = "splunk-forwarder";
  version = "9.1.7";
  version_long = "${version}-e17104057ef0";

  src = fetchurl {
    url = "https://download.splunk.com/products/universalforwarder/releases/${version}/linux/splunkforwarder-${version_long}-Linux-x86_64.tgz";
    hash = "sha256-EWpfenEhExe5qDscqb7ZQUwahYgAgPQ+APLlweRQAoc=";
  };

  nativeBuildInputs = [autoPatchelfHook];

  buildInputs = [
    #    alsaLib
    openssl
    zlib
  ];

  sourceRoot = ".";

  installPhase = ''
    runHook preInstall
    # gets unzipped and we just pop it all into teh output
    # might add the patching of the path vars in the scripts to be here
    cp -R ./splunkforwarder $out
    runHook postInstall
  '';

  meta = with lib; {
    homepage = "https://splunk.com";
    description = "Logging Service";
    platforms = platforms.linux;
  };
}