topic Re: Unable to start splunkforwarder service on windows server in Deployment Architecture

Unable to start splunkforwarder service on windows server

anoopambli — Thu, 29 Nov 2012 13:55:22 GMT

I've installed universal (splunkforwarder-5.0.1-143156-x86-release.msi) on a windows 2003 server (32 bit) using commandline option

msiexec.exe /i "C:\temp\splunkforwarder-5.0.1-143156-x86-release.msi" AGREETOLICENSE=Yes LAUNCHSPLUNK=0 /quiet

I am trying to start splunkforwarder service after the installation is done but it is giving me this error message.

"Could not start Splunkforwarder service on Local computer. Error 1067: The process terminated unexpectedly"

Any idea how to fix this?

Re: Unable to start splunkforwarder service on windows server

DaveSavage — Thu, 29 Nov 2012 14:26:06 GMT

Anoopambli - did you set FORWARD_SERVER="destserver:port" so that the forwarder knows where it is sending logs to?
Are your domain rights / account ok, members of local Admin Group etc (maybe you are domain admin ;-)?

Re: Unable to start splunkforwarder service on windows server

anoopambli — Thu, 29 Nov 2012 14:31:13 GMT

I am using a domain account to perform this installation. I left out forward_server option as we wanted to put those config through a deployment server.

Manual installation through GUI also fails with the same error message.

Re: Unable to start splunkforwarder service on windows server

DaveSavage — Mon, 28 Sep 2020 12:53:02 GMT

Hmm...am not sure if it can 'wait' to find that param out, maybe it can. I didn't see it above, but there is another param if you are using a deploy server (DEPLOYMENT_SERVER="hostdets:port")?
The GUI option was the other suggestion, yes. However if you are entering the same info / or not, it may just be replicating the issue.
Can you try (either) with the FORWARD_SERVER...?

Re: Unable to start splunkforwarder service on windows server

Drainy — Thu, 29 Nov 2012 14:47:29 GMT

a forwarder doesn't have to have any inputs or outputs configured to start correctly. Have you had a look in your Windows Event logs to see if it logged any more detail? How are you trying to start it?

Re: Unable to start splunkforwarder service on windows server

DaveSavage — Thu, 29 Nov 2012 14:48:11 GMT

Further thoughts - have you tried starting Splunk manually to see where in the startup sequence it is failing?
/program files/Splunk/bin/splunk start or ..splunk start --accept-license for good measure?

Re: Unable to start splunkforwarder service on windows server

anoopambli — Thu, 29 Nov 2012 15:43:41 GMT

I tried /program files/Splunk/bin/splunk start and it gives error as below.

Splunk> CSI: Logfiles.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for typos... Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
SplunkForwarder: Starting (pid 7636)

Timed out waiting for splunkd to start.

Re: Unable to start splunkforwarder service on windows server

Drainy — Thu, 29 Nov 2012 15:56:04 GMT

have a look at splunkd.log in the splunk_home/var/log/splunk directory

Re: Unable to start splunkforwarder service on windows server

DanRogl — Mon, 03 Dec 2012 18:04:20 GMT

How does the service run? Under a domain account? If so grant the service account modify access to the Program Files\Splunk directory.

Re: Unable to start splunkforwarder service on windows server

DaveSavage — Mon, 03 Dec 2012 18:22:11 GMT

Er Dan - I think we asked that question a few 'comments' / Q's ago? Check above...but essentially in the right space...