https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503449#M17265 <P>windows could not start splunkforwarder service on local computer<BR /> error - 1067 - The process terminated unexpectedly <BR /> splunkd logs , Where do I look for lock files , How to solve this on windows <BR /> 10-12-2019 09:59:33.615 -0700 FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting.<BR /> 10-12-2019 10:00:34.568 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:00:44.584 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:00:54.600 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:04.615 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:14.631 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:24.647 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:34.662 -0700 FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting.<BR /> 10-12-2019 10:01:51.147 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:02:01.163 -0700 WARN loader - Sleep 10 sec, waiting for config lock.</P> Wed, 30 Sep 2020 02:36:18 GMT dipinp 2020-09-30T02:36:18Z https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503449#M17265 <P>windows could not start splunkforwarder service on local computer<BR /> error - 1067 - The process terminated unexpectedly <BR /> splunkd logs , Where do I look for lock files , How to solve this on windows <BR /> 10-12-2019 09:59:33.615 -0700 FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting.<BR /> 10-12-2019 10:00:34.568 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:00:44.584 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:00:54.600 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:04.615 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:14.631 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:24.647 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:01:34.662 -0700 FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting.<BR /> 10-12-2019 10:01:51.147 -0700 WARN loader - Sleep 10 sec, waiting for config lock.<BR /> 10-12-2019 10:02:01.163 -0700 WARN loader - Sleep 10 sec, waiting for config lock.</P> Wed, 30 Sep 2020 02:36:18 GMT https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503449#M17265 dipinp 2020-09-30T02:36:18Z https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503450#M17266 <P>What does it say in splunkd_stderr.log?</P> Sat, 12 Oct 2019 23:46:42 GMT https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503450#M17266 richgalloway 2019-10-12T23:46:42Z https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503451#M17267 <P>As mentioned on the previously post by richgalloway, you have to check the error messages on file splunkd_stderr.log.</P> <P>Check if the user that you are installing the UF client has the access granted to start the service<BR /> you can either use the windows system local account or domain account where the user has privilege access to start splunk service<BR /> Remove the UF client from this server.<BR /> Verify if you have any local server police from anti-virus or other software that monitores the server that can prevent splunk service to be started.<BR /> Also check the windows logs on the server, because if there is any problem with permissions, there is potential the error will be there<BR /> Install the UF client again on a sandbox server where you can run your troubleshooting or either test the different windows accounts who has access to process changes on the system.</P> <P><A href="https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/InstallaWindowsuniversalforwarderfromthecommandline">https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/InstallaWindowsuniversalforwarderfromthecommandline</A></P> Tue, 15 Oct 2019 22:59:09 GMT https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503451#M17267 ivanreis 2019-10-15T22:59:09Z https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503452#M17268 <P>Hey,</P> <P>I don't have this log file under C:\Program Files\SplunkUniversalForwarder\var\log\splunk</P> Wed, 16 Oct 2019 12:00:16 GMT https://community.splunk.com/t5/Deployment-Architecture/unable-to-start-splunkforwarder-from-services-msc-1067-error/m-p/503452#M17268 dipinp 2019-10-16T12:00:16Z