https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwader-constantly-crashes-with-quot-Crashing/m-p/268998#M51650 <P>The interesting thing that the crashing thread is indexerPipe. The indexerPipe should be disabled on Universal Forwarder as it does not Index data.</P> <P>Looking at splunkd.log we see several errors like:</P> <P>WARN IndexerService - Indexer was started dirty: splunkd startup may take longer than usual; searches may not be accurate until background fsck completes.<BR /> ERROR IndexConfig - stanza=default Required parameter=defaultDatabase not configured<BR /> FATAL IndexerService - Cannot load IndexConfig: stanza=default Required parameter=defaultDatabase not configured<BR /> ERROR IndexConfig - stanza=default Required parameter=defaultDatabase not configured<BR /> FATAL IndexerService - Cannot load IndexConfig: stanza=default Required parameter=defaultDatabase not configured<BR /> INFO IndexProcessor - Initializing: readonly=false reloading=false</P> <P>This suggests that the indexPipeline is enabled and the Universal Forwarder is trying to find index components which do not exist.</P> <P>On a Universal Forwarder there are several pipe lines that should be disabled. These are configured in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/default/default-mode.conf<BR /> which contains stanzas like</P> <PRE><CODE>#This file turns off pipelines and processors. #This is the default configuration #Turn off a processor [pipeline:indexerPipe] disabled_processors= indexer, indexandforward, diskusage, signing,tcp-output-generic-processor, syslog-output-generic-processor, http-output-generic-processor, stream-output-processor [pipeline:distributedSearch] disabled = true [pipeline:fifo] disabled = true [pipeline:merging] disabled = true [pipeline:typing] disabled = true </CODE></PRE> <P>The issue was caused by the fact the SplunkUniversalForwarder app had been deleted from $SPLUNK_HOME/etc/apps, leaving the indexing pipeline enabled.</P> <P>It is not recommended to delete / change the default apps installed by default in $SPLUNK_HOME/etc/apps (introspection_generator_addon search, SplunkUniversalForwarder, learned and splunk_httpinput) or manage these apps via Splunk Deployment Server (Forwarder Managerment)</P> Tue, 29 Sep 2020 12:39:47 GMT dshakespeare_sp 2020-09-29T12:39:47Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwader-constantly-crashes-with-quot-Crashing/m-p/268997#M51649 <P>Splunk Universal Forwader constantly crashes with "Crashing thread: indexerPipe". <BR /> splunkd.log shows:</P> <PRE><CODE>WARN IndexerService - Indexer was started dirty: splunkd startup may take longer than usual; searches may not be accurate until background fsck completes. ERROR IndexConfig - stanza=default Required parameter=defaultDatabase not configured FATAL IndexerService - Cannot load IndexConfig: stanza=default Required parameter=defaultDatabase not configured ERROR IndexConfig - stanza=default Required parameter=defaultDatabase not configured FATAL IndexerService - Cannot load IndexConfig: stanza=default Required parameter=defaultDatabase not configured INFO IndexProcessor - Initializing: readonly=false reloading=false </CODE></PRE> Mon, 30 Jan 2017 08:05:19 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwader-constantly-crashes-with-quot-Crashing/m-p/268997#M51649 dshakespeare_sp 2017-01-30T08:05:19Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwader-constantly-crashes-with-quot-Crashing/m-p/268998#M51650 <P>The interesting thing that the crashing thread is indexerPipe. The indexerPipe should be disabled on Universal Forwarder as it does not Index data.</P> <P>Looking at splunkd.log we see several errors like:</P> <P>WARN IndexerService - Indexer was started dirty: splunkd startup may take longer than usual; searches may not be accurate until background fsck completes.<BR /> ERROR IndexConfig - stanza=default Required parameter=defaultDatabase not configured<BR /> FATAL IndexerService - Cannot load IndexConfig: stanza=default Required parameter=defaultDatabase not configured<BR /> ERROR IndexConfig - stanza=default Required parameter=defaultDatabase not configured<BR /> FATAL IndexerService - Cannot load IndexConfig: stanza=default Required parameter=defaultDatabase not configured<BR /> INFO IndexProcessor - Initializing: readonly=false reloading=false</P> <P>This suggests that the indexPipeline is enabled and the Universal Forwarder is trying to find index components which do not exist.</P> <P>On a Universal Forwarder there are several pipe lines that should be disabled. These are configured in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/default/default-mode.conf<BR /> which contains stanzas like</P> <PRE><CODE>#This file turns off pipelines and processors. #This is the default configuration #Turn off a processor [pipeline:indexerPipe] disabled_processors= indexer, indexandforward, diskusage, signing,tcp-output-generic-processor, syslog-output-generic-processor, http-output-generic-processor, stream-output-processor [pipeline:distributedSearch] disabled = true [pipeline:fifo] disabled = true [pipeline:merging] disabled = true [pipeline:typing] disabled = true </CODE></PRE> <P>The issue was caused by the fact the SplunkUniversalForwarder app had been deleted from $SPLUNK_HOME/etc/apps, leaving the indexing pipeline enabled.</P> <P>It is not recommended to delete / change the default apps installed by default in $SPLUNK_HOME/etc/apps (introspection_generator_addon search, SplunkUniversalForwarder, learned and splunk_httpinput) or manage these apps via Splunk Deployment Server (Forwarder Managerment)</P> Tue, 29 Sep 2020 12:39:47 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwader-constantly-crashes-with-quot-Crashing/m-p/268998#M51650 dshakespeare_sp 2020-09-29T12:39:47Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwader-constantly-crashes-with-quot-Crashing/m-p/268999#M51651 <P>I downvoted this post because wrong one vote for sorry</P> Mon, 30 Jan 2017 08:31:08 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwader-constantly-crashes-with-quot-Crashing/m-p/268999#M51651 nclancy_splunk 2017-01-30T08:31:08Z