All Apps and Add-ons

splunk-monitornohandle - configure: no drive specifier found

suzakutheknight
New Member

We are receinving the error below in our environment after deploying the Splunk Add-on for Microsoft Windows:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: no drive specifier found: '$windir\system32\dns\dns.log'

The target systems are running Windows Server 2012 R2 Standard, and the universal forwarder is running as the local system account.

Splunk Component Versions:
Splunk Enterprise 8.0.1
Splunk Universal Forwarder 7.3.4
Splunk Add-on for Microsoft Windows 7.0.0

Any guidance on troubleshooting this would be greatly appreciated.

0 Karma
1 Solution

jwiedow
Communicator

If you change the monitor stanza to use the actual drive letter (C:\Windows) instead of $windir does it work?

View solution in original post

0 Karma

jwiedow
Communicator

If you change the monitor stanza to use the actual drive letter (C:\Windows) instead of $windir does it work?

View solution in original post

0 Karma

suzakutheknight
New Member

Sorry for the delay, I wanted to run the updated configuration for long enough to validate the change.

Updating the input from "MonitorNoHandle://$WINDIR\System32\Dns\dns.log" to "MonitorNoHandle://C:\Windows\System32\Dns\dns.log" does indeed resolve the issue. What's really odd though is the $WINDIR variable seems to be working in other inputs. For example, "monitor://$WINDIR\WindowsUpdate.log" being enabled does not generate the error.

My guess is that the issue is something specific to the resolution of environment variables by the MonitorNoHandle process. While all of our systems do have C: for the OS drive, it would be more ideal to use the environment variable to protect against edge cases. Is there any thing else we can do to troubleshoot further, or is it time for a bug report?

0 Karma

jwiedow
Communicator

Good to know. Have you tried 8.0.0 of the Splunk Add-on for Microsoft Windows and seen if the issue persists there with the variable substitution?

0 Karma

suzakutheknight
New Member

We have not. I'll get that and updating the Windows Server 2012 forwarders to 7.3.5 onto our patching schedule to see if either resolves the issue. Given that will not be a swift process due to some bureaucracy, would it be best to mark this question as resolved with removing the environmental variable as a work around solution?

0 Karma

jwiedow
Communicator

I would try to test it on at least one test server and see if it resolves the problem. I don't see anything in the release notes about it fixing an issue with the monitor-nohandle but that doesn't necessarily mean anything.

The quickest thing to do is to open a support case with the information and see if they are aware of the issue. It definitely sounds like a bug.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!