https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190063#M19352 <BLOCKQUOTE> <P>After i installed the file the errors<BR /> were resolved and i was able to<BR /> successfully monitor the DNS debug<BR /> file</P> </BLOCKQUOTE> <P>What do you mean by "installed the file"? You say the file is already there. (...?)</P> Wed, 08 Mar 2017 12:34:08 GMT reedmohn 2017-03-08T12:34:08Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190061#M19350 <P>Hi,</P> <P>I'm receiving a bunch of splunk-MonitorNoHandle errors in the splunkd log. These errors are coming from domain controllers with the Universal Forwarder installed with apps Splunk_TA_windows, TA-DNSServer-NT6, and TA-DomainController-NT6. I can't seem to find anything online about these error messages and what they could mean. Does anyone have experience with these errors?</P> <PRE><CODE>message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - DisplayError: The system cannot find the file specified.\r\n message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - GetServiceHandle - OpenService failure for 'SplunkMonitorNoHandle'! Error = 1060 message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - StopDriver: Failed to get service handle 0x424 message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - runWinMonitorNoHandleMon: Could not connect to filter driver 0x80070002 </CODE></PRE> Tue, 29 Sep 2020 07:05:53 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190061#M19350 cborgal 2020-09-29T07:05:53Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190062#M19351 <P>I was getting these errors also. There is a file called SplunkMonitorNoHandledrv.inf in the bin directory. After i installed the file the errors were resolved and i was able to successfully monitor the DNS debug file</P> Thu, 01 Dec 2016 22:53:57 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190062#M19351 ajacobi 2016-12-01T22:53:57Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190063#M19352 <BLOCKQUOTE> <P>After i installed the file the errors<BR /> were resolved and i was able to<BR /> successfully monitor the DNS debug<BR /> file</P> </BLOCKQUOTE> <P>What do you mean by "installed the file"? You say the file is already there. (...?)</P> Wed, 08 Mar 2017 12:34:08 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190063#M19352 reedmohn 2017-03-08T12:34:08Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190064#M19353 <P>It is already there. It is an inf file so you can right-click it and select install.</P> Wed, 08 Mar 2017 20:48:04 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190064#M19353 ajacobi 2017-03-08T20:48:04Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190065#M19354 <P>Ah.. literally install it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> I thought maybe you meant moving it to some specific folder. Tnx!</P> Thu, 09 Mar 2017 08:25:44 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190065#M19354 reedmohn 2017-03-09T08:25:44Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190066#M19355 <P>No worries mate. Hope it helps</P> Thu, 09 Mar 2017 09:20:02 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190066#M19355 ajacobi 2017-03-09T09:20:02Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190067#M19356 <P>Installing the inf file seems to have done the trick on our servers as well.</P> <P>One thing we noted: most servers were OK, but some 2008 R2 servers were not. </P> <P>Apart from that, it seems that it is Server 2012, and 2008 core / 2012 core that have failed to pick this up on their own.</P> Mon, 13 Mar 2017 13:59:09 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190067#M19356 reedmohn 2017-03-13T13:59:09Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190068#M19357 <P>I found that also. Half were ok but the other half had issues. At least it's a simple fix</P> Mon, 13 Mar 2017 21:11:27 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-am-I-getting-splunk-MonitorNoHandle-errors-in-the-splunkd/m-p/190068#M19357 ajacobi 2017-03-13T21:11:27Z