topic Re: Is it normal behavior for a Windows universal forwarder to have multiple Splunk processes in a terminated state? in Getting Data In

Is it normal behavior for a Windows universal forwarder to have multiple Splunk processes in a terminated state?

anoopambli — Thu, 25 Jun 2015 13:23:28 GMT

Why does the universal forwarder generate many splunk.exe processes and terminate them? i have a plain installation of a UF on Windows servers. It is not configured to send anything to an indexer at this point. Every time I start the forwarder it is creating multiple splunk processes.

eg:
splunk-regmon.exe
splunk-netmon.exe
splunk-admon.exe
etc.

I've added the below entries in inputs to avoid starting them, but they still get generated and stays in a terminated state.

Is this normal? Are they getting created because of any standard start up check?

Inputs.conf file

[default]
host = FIDSLC011ADS

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 1

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path] disabled = 1
[script://$SPLUNK_HOME\bin\scripts\splunk-admon.path] disabled = 1
[script://$SPLUNK_HOME\bin\scripts\splunk-netmon.path] disabled = 1

Re: Is it normal behavior for a Windows universal forwarder to have multiple Splunk processes in a terminated state?

Michael — Tue, 10 Oct 2017 13:32:02 GMT

Same here, in 2017; v 6.5.3.

Have a deployed environment. Have dozens of systems getting a deployment package with regmon.path set with "disabled = 1" and yet they continue to generate millions of entries a day.

Still working the issue...

Re: Is it normal behavior for a Windows universal forwarder to have multiple Splunk processes in a terminated state?

gjanders — Tue, 10 Oct 2017 13:49:26 GMT

Does this relate to another Splunk answer such as Why are these additional Splunk processes starting and stopping on Windows hosts configured with Universal Forwarders? ?

Perhaps run:

splunk btool inputs list --debug

On the universal forwarder, if your in Windows 2008 you will need to run in an admin cmd window...
This should tell you if the disabled is working as expected or not...