topic Re: SPLUNK Universal Forwarder on Windows Server Core in Getting Data In https://community.splunk.com/t5/Getting-Data-In/SPLUNK-Universal-Forwarder-on-Windows-Server-Core/m-p/366439#M66640 <P>For me a reboot helped.</P> <P>You can also check the user permissions.</P> Wed, 07 Feb 2018 04:59:58 GMT ansif 2018-02-07T04:59:58Z SPLUNK Universal Forwarder on Windows Server Core https://community.splunk.com/t5/Getting-Data-In/SPLUNK-Universal-Forwarder-on-Windows-Server-Core/m-p/366438#M66639 <P>I have several domain controllers, running the core version of Windows Server, reporting these errors in the splunkd logs:</P> <PRE><CODE>01-30-2018 03:36:50.596 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - startDriver - StartService failure for splunkdrv! Error = 201-30-2018 03:36:50.596 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - WinRegistryMonitor::StartDriver: Unable to install driver.01-30-2018 03:36:50.596 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - stopDriver - Service 'splunkdrv' could not be stopped! Error = 1062 01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - GetServiceHandle - OpenService failure for 'SplunkMonitorNoHandle'! Error = 1060 01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - runWinMonitorNoHandleMon: Could not connect to filter driver 0x80070002 01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - DisplayError: %01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - GetServiceHandle - OpenService failure for 'SplunkMonitorNoHandle'! Error = 1060 </CODE></PRE> <P>I would appreciate any help resolving these. I'm assuming since it is the "core" O/S, there is something locked down or missing that is required for SPLUNK to gather the data.</P> Tue, 06 Feb 2018 15:21:42 GMT https://community.splunk.com/t5/Getting-Data-In/SPLUNK-Universal-Forwarder-on-Windows-Server-Core/m-p/366438#M66639 KevinMurray 2018-02-06T15:21:42Z Re: SPLUNK Universal Forwarder on Windows Server Core https://community.splunk.com/t5/Getting-Data-In/SPLUNK-Universal-Forwarder-on-Windows-Server-Core/m-p/366439#M66640 <P>For me a reboot helped.</P> <P>You can also check the user permissions.</P> Wed, 07 Feb 2018 04:59:58 GMT https://community.splunk.com/t5/Getting-Data-In/SPLUNK-Universal-Forwarder-on-Windows-Server-Core/m-p/366439#M66640 ansif 2018-02-07T04:59:58Z Re: SPLUNK Universal Forwarder on Windows Server Core https://community.splunk.com/t5/Getting-Data-In/SPLUNK-Universal-Forwarder-on-Windows-Server-Core/m-p/540532#M90503 <P>Run "Repair' or reinstall the Splunk Application</P> Fri, 19 Feb 2021 13:56:38 GMT https://community.splunk.com/t5/Getting-Data-In/SPLUNK-Universal-Forwarder-on-Windows-Server-Core/m-p/540532#M90503 dbot2001 2021-02-19T13:56:38Z