{
  stdenv,
  lib,
  fetchurl,
  gnused,
  openssl,
  zlib,
  autoPatchelfHook,
}:
stdenv.mkDerivation rec {
  pname = "splunk-forwarder";
  version = "9.1.7";
  version_long = "${version}-e17104057ef0";

  src = fetchurl {
    url = "https://download.splunk.com/products/universalforwarder/releases/${version}/linux/splunkforwarder-${version_long}-Linux-x86_64.tgz";
    hash = "sha256-EWpfenEhExe5qDscqb7ZQUwahYgAgPQ+APLlweRQAoc=";
  };

  nativeBuildInputs = [autoPatchelfHook];

  buildInputs = [
    #    alsaLib
    openssl
    zlib
    gnused
  ];

  sourceRoot = ".";

  installPhase = ''
    runHook preInstall
    # gets unzipped and we just pop it all into teh output
    cp -R ./splunkforwarder $out

    # Splunk is doing a crime by deciding what teh path is, need to comment out this line in /bin/pid_check.sh
    # PATH=/usr/xpg4/bin:/usr/bin:/bin
    find $out -type f -name "*.sh" -print0 | xargs -0 sed -i -e 's/PATH=/#PATH=/g'

    runHook postInstall
  '';

  meta = with lib; {
    homepage = "https://splunk.com";
    description = "Logging Service";
    platforms = platforms.linux;
  };
}