Why did Agent splunk ended prematurely Windows Server 2012 R2?

EFFE4 — Mon, 25 Jul 2022 16:05:12 GMT

Hi all,

I have a problem with installing splunk agent on windows 2012 R2 server.

I follow the installation via the wizard however the installation fails without returning error messages.

I have attempted to install the following versions without success:

9.0.0
8.2.7
7.2.0

Below are the errors present in the log file C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd-utility:

07-25-2022 11:46:10.287 +0200 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
07-25-2022 11:46:10.287 +0200 INFO ServerConfig - Host name option is "".
07-25-2022 11:46:10.318 +0200 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts
07-25-2022 11:46:11.522 +0200 ERROR LimitsHandler - Configuration from app=SplunkUniversalForwarder does not support reload: limits.conf/[thruput]/maxKBps
07-25-2022 11:46:11.522 +0200 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for limits (access_endpoints /server/status/limits/general): Bad Request
07-25-2022 11:46:11.522 +0200 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for server (http_post /replication/configuration/whitelist-reload): Application does not exist: Not Found
07-25-2022 11:46:11.522 +0200 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for web (http_post /server/control/restart_webui_polite): Application does not exist: Not Found
07-25-2022 11:46:11.522 +0200 WARN LocalAppsAdminHandler - User 'splunk-system-user' triggered the 'enable' action on app 'SplunkUniversalForwarder', and the following objects required a restart: default-mode, limits, server, web

Thank you in advance for the support,
Regards.

Fabio.

Re: Agent splunk ended prematurely Windows Server 2012 R2

gcusello — Mon, 25 Jul 2022 10:16:02 GMT

Hi @EFFE4,

is there any protection system on your server: antivirus, or other?

Anyway, I hint to open a Case to Splunk Support.

Ciao.

Giuseppe

Re: Agent splunk ended prematurely Windows Server 2012 R2

EFFE4 — Mon, 25 Jul 2022 10:49:11 GMT

Hi @gcusello ,

Yes, on the server is present the antivirus, do you think that this is the problem?

Ciao,

Fabio.

Re: Agent splunk ended prematurely Windows Server 2012 R2

gcusello — Mon, 25 Jul 2022 10:51:12 GMT

Hi @EFFE4,

I don't know, maybe it depends on the Antivirus, anyway try to temporary disable it and if the issue is still present open a ticket to Splunk Support.

Ciao.

Giuseppe

topic Why did Agent splunk ended prematurely Windows Server 2012 R2? in Installation

Why did Agent splunk ended prematurely Windows Server 2012 R2?

Re: Agent splunk ended prematurely Windows Server 2012 R2

Re: Agent splunk ended prematurely Windows Server 2012 R2

Re: Agent splunk ended prematurely Windows Server 2012 R2