https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386917#M69405 <OL> <LI>Could you please share some more information from splunkd.log</LI> <LI>Could be a possibility something is wrong with log.cfg file &lt; PATH: $SPLUNK_HOME/etc/log.cfg &gt;</LI> </OL> Fri, 12 Jul 2019 13:15:06 GMT sunnyb147 2019-07-12T13:15:06Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386916#M69404 <P>Maybe someone here could help me as i have issue on starting the SPLUNK forwarder.<BR /> Here's the full error upon trying to start the forwarder</P> <P>Checking prerequisites...<BR /> Management port has been set disabled; cli support for this configuration is currently incomplete.<BR /> Checking conf files for typos... Done<BR /> All preliminary checks passed.</P> <P>Starting splunk server daemon (splunkd)...<BR /> Error loading logging config file</P> <P>Timed out waiting for splunkd to start.</P> Fri, 12 Jul 2019 12:28:43 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386916#M69404 Manilyn 2019-07-12T12:28:43Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386917#M69405 <OL> <LI>Could you please share some more information from splunkd.log</LI> <LI>Could be a possibility something is wrong with log.cfg file &lt; PATH: $SPLUNK_HOME/etc/log.cfg &gt;</LI> </OL> Fri, 12 Jul 2019 13:15:06 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386917#M69405 sunnyb147 2019-07-12T13:15:06Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386918#M69406 <P>07-08-2019 17:22:55.806 -0500 WARN Logger - $SPLUNK_HOME/etc/log.cfg:263: Pa<BR /> rse error at "appender.idata_ResourceUsage.serialization=JSON"<BR /> 07-08-2019 17:22:55.807 -0500 WARN Logger - $SPLUNK_HOME/etc/log.cfg:273: Pa<BR /> rse error at "appender.idata_DiskObjects.serialization=JSON"<BR /> 07-08-2019 17:25:56.521 -0500 WARN Logger - $SPLUNK_HOME/etc/log.cfg:263: Pa<BR /> rse error at "appender.idata_ResourceUsage.serialization=JSON"<BR /> 07-08-2019 17:25:56.522 -0500 WARN Logger - $SPLUNK_HOME/etc/log.cfg:273: Pa<BR /> rse error at "appender.idata_DiskObjects.serialization=JSON"<BR /> 07-12-2019 07:00:43.255 -0500 WARN Logger - $SPLUNK_HOME/etc/log.cfg:263: Pa<BR /> rse error at "appender.idata_ResourceUsage.serialization=JSON"<BR /> 07-12-2019 07:00:43.255 -0500 WARN Logger - $SPLUNK_HOME/etc/log.cfg:273: Pa<BR /> rse error at "appender.idata_DiskObjects.serialization=JSON"</P> Wed, 30 Sep 2020 01:18:23 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386918#M69406 Manilyn 2020-09-30T01:18:23Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386919#M69407 <P>You should be able to see more specific errors in <STRONG><EM>/opt/splunk/var/log/splunk/splunkd.log</EM></STRONG>.<BR /> Share some of the log if you're not able to determine what the problem is.</P> Fri, 12 Jul 2019 17:01:43 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386919#M69407 oscar84x 2019-07-12T17:01:43Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386920#M69408 <P>I resolved the issue by commenting JSON lines from log.cfg</P> Fri, 12 Jul 2019 17:40:27 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/386920#M69408 Manilyn 2019-07-12T17:40:27Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/654074#M110903 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/190775">@Manilyn</a>&nbsp;,</P><P>&nbsp;</P><P>Could you please let me know what all changes you performed on log.cfg?</P> Fri, 11 Aug 2023 13:03:15 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-start-Splunk-forwarder/m-p/654074#M110903 subham29 2023-08-11T13:03:15Z