Archive

Does not start splunk forwarder service

paola92
Explorer

I have installed splunk forwarder for a windows servers and the service must be initialized when the server starts but some times the service doesn't start so I need to know how to see why the service doesn't start or how I must configure the service.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi paola92
three checks:

  • at first,verify if the Splunk Universal Forwarder version you're using is supported for that Windows Operative System version.
  • then start Splunk using CLI instead of Windows Services, so you can see the start-up messages;
  • then search error messages in $SPLUNK_HOME\var\log\splunk\splunkd.log.

Usually using CLI you reach to display start-up errors (e.g. memory or grants problems).

Then share these messages to better understand your problem.

If this problem is about an active customer, you can also open a case to Splunk Support and be supported by them.

Ciao.
Giuseppe

0 Karma

ktn01
Path Finder

Hello,

Do you check the content of "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log" ?

Regards
Christian

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!