topic Re: error starting universal forwarder in Deployment Architecture

error starting universal forwarder

a212830 — Tue, 16 Apr 2013 23:43:31 GMT

I am getting the following error starting up a UF on Windows 2008 64-bit server:

4-16-2013 15:57:26.770 -0400 FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details.

I don't see a splunkd_stderr.log in ../var/log/splunk. Would it be somewhere else? I also get an error 1067 when trying to start it via services.

Re: error starting universal forwarder

kristian_kolb — Wed, 17 Apr 2013 06:29:37 GMT

It should be in $SPLUNK_HOME/var/log/splunk

Have a look here;

http://splunk-base.splunk.com/answers/73843/splunk-will-not-start-and-is-waiting-for-config-lock

Re: error starting universal forwarder

a212830 — Wed, 17 Apr 2013 12:16:18 GMT

That worked. Thanks!

Re: error starting universal forwarder

jrodman — Fri, 14 Nov 2014 15:33:43 GMT

On Windows, we lack a splunkd_stderr.log, so this message is misleading.

However, the most likely cause of the problem is fixed in Splunk 6.1.3. If you see it after 6.1.3, then you may want to doublecheck permissions etc on var/run/splunk/conf-mutator.pid and/or contact support.