topic Re: After setting up a universal forwarder and receiver on Windows, why am I getting "Error in 'DispatchProcess': Failed to write the info file to C:\Program Files\Splunk\var\run\splunk\dispatch\[lots of letters and numbers]\info.csv"? in Getting Data In

After setting up a universal forwarder and receiver on Windows, why am I getting "Error in 'DispatchProcess': Failed to write the info file to C:\Program Files\Splunk\var\run\splunk\dispatch\[lots of letters and numbers]\info.csv"?

mr_dombat — Tue, 17 Nov 2015 15:39:05 GMT

I've set up a universal forwarder on a remote webserver using local system account (Win2008R2 64bit).

I have enabled receiving on the receiver which is using a domain account (Win7 Pro 64bit). It asked to restart Splunk which I did.

The dashboard is now showing:

Error in 'DispatchProcess': Failed to write the info file to C:\Program Files\Splunk\var\run\splunk\dispatch\[lots of letters and numbers]\info.csv

Re: After setting up a universal forwarder and receiver on Windows, why am I getting "Error in 'DispatchProcess': Failed to write the info file to C:\Program Files\Splunk\var\run\splunk\dispatch\[lots of letters and numbers]\info.csv"?

nbjoshi_splunk — Tue, 17 Nov 2015 22:53:47 GMT

Are you sure you installed the Splunk Universal Forwarder and not a full Splunk installation? I would expect the directory to be C:\Program Files\SplunkUniversalForwarder....

In regards to your error, you might have some old erroneous results stored in the dispatch directory. You can manually clear out the "[lots of letters and numbers]" directory and restart Splunk and this should resolve the issue.

Re: After setting up a universal forwarder and receiver on Windows, why am I getting "Error in 'DispatchProcess': Failed to write the info file to C:\Program Files\Splunk\var\run\splunk\dispatch\[lots of letters and numbers]\info.csv"?

mr_dombat — Wed, 18 Nov 2015 10:15:32 GMT

The error message was manifesting itself in the full splunk.

On the indexer/receiver I deleted the files as requested it made no difference.

I changed the two services to run as interactive desktop enabled LocalService and restarted splunk, same messages.

I checked permissions on the folder(s) and added my domain and localsevice both as Full control, restarted, same messages.

I uninstalled Splunk, cleaned the registry using CCLeaner, rebooted, reinstalled using Local account (default setting) and it seems OK now.

Not getting anything from my forwarders still but that is a different question.