https://community.splunk.com/t5/Getting-Data-In/Losing-connect-with-splunk-forwarder/m-p/445507#M77521 <P>on the forwarder do to the splunkd.log and look for errors or crashes.<BR /> also look for crash.log in the same spot<BR /> in windows its most likely at:<BR /> <CODE>C:\Program Files\SplunkUniversalForwarder\var\log\splunk</CODE></P> Tue, 14 May 2019 01:13:42 GMT adonio 2019-05-14T01:13:42Z https://community.splunk.com/t5/Getting-Data-In/Losing-connect-with-splunk-forwarder/m-p/445506#M77520 <P>Hi Splunker;</P> <P>In initial the connect between deployment server and windows forwarder is good and splunk receiving logs from it.</P> <P>Then occurred losing connect from it, and I check to splunkforwarder status, the splunkforwarder status is stropped and check ports the ports is open, and I executed (splunk start) command appeared the following error:</P> <P>(Timed out waiting for splunkd to start).</P> <P>And some times the splunk agent service suddenly stopped in windows devices and I must execute the splunk start command for run, this case is always repeated, please I need your advise in that.</P> <P>Regards; </P> Thu, 02 May 2019 12:15:01 GMT https://community.splunk.com/t5/Getting-Data-In/Losing-connect-with-splunk-forwarder/m-p/445506#M77520 aalhabbash1 2019-05-02T12:15:01Z https://community.splunk.com/t5/Getting-Data-In/Losing-connect-with-splunk-forwarder/m-p/445507#M77521 <P>on the forwarder do to the splunkd.log and look for errors or crashes.<BR /> also look for crash.log in the same spot<BR /> in windows its most likely at:<BR /> <CODE>C:\Program Files\SplunkUniversalForwarder\var\log\splunk</CODE></P> Tue, 14 May 2019 01:13:42 GMT https://community.splunk.com/t5/Getting-Data-In/Losing-connect-with-splunk-forwarder/m-p/445507#M77521 adonio 2019-05-14T01:13:42Z