topic Re: Does not start splunk forwarder service in Deployment Architecture

Does not start splunk forwarder service

paola92 — Fri, 01 Nov 2019 13:43:36 GMT

I have installed splunk forwarder for a windows servers and the service must be initialized when the server starts but some times the service doesn't start so I need to know how to see why the service doesn't start or how I must configure the service.

Re: Does not start splunk forwarder service

ktn01 — Fri, 01 Nov 2019 14:19:49 GMT

Hello,

Do you check the content of "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log" ?

Regards
Christian

Re: Does not start splunk forwarder service

gcusello — Sat, 02 Nov 2019 11:07:48 GMT

Hi paola92
three checks:

at first,verify if the Splunk Universal Forwarder version you're using is supported for that Windows Operative System version.
then start Splunk using CLI instead of Windows Services, so you can see the start-up messages;
then search error messages in $SPLUNK_HOME\var\log\splunk\splunkd.log.

Usually using CLI you reach to display start-up errors (e.g. memory or grants problems).

Then share these messages to better understand your problem.

If this problem is about an active customer, you can also open a case to Splunk Support and be supported by them.

Ciao.
Giuseppe