I've installed universal (splunkforwarder-5.0.1-143156-x86-release.msi) on a windows 2003 server (32 bit) using commandline option
msiexec.exe /i "C:\temp\splunkforwarder-5.0.1-143156-x86-release.msi" AGREETOLICENSE=Yes LAUNCHSPLUNK=0 /quiet
I am trying to start splunkforwarder service after the installation is done but it is giving me this error message.
"Could not start Splunkforwarder service on Local computer. Error 1067: The process terminated unexpectedly"
Any idea how to fix this?
I tried /program files/Splunk/bin/splunk start and it gives error as below.
Splunk> CSI: Logfiles.
Checking mgmt port : open
Checking conf files for typos... Done
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
SplunkForwarder: Starting (pid 7636)
Timed out waiting for splunkd to start.
Further thoughts - have you tried starting Splunk manually to see where in the startup sequence it is failing?
/program files/Splunk/bin/splunk start or ..splunk start --accept-license for good measure?
a forwarder doesn't have to have any inputs or outputs configured to start correctly. Have you had a look in your Windows Event logs to see if it logged any more detail? How are you trying to start it?
Hmm...am not sure if it can 'wait' to find that param out, maybe it can. I didn't see it above, but there is another param if you are using a deploy server (DEPLOYMENTSERVER="hostdets:port")?
The GUI option was the other suggestion, yes. However if you are entering the same info / or not, it may just be replicating the issue.
Can you try (either) with the FORWARDSERVER...?
I am using a domain account to perform this installation. I left out forward_server option as we wanted to put those config through a deployment server.
Manual installation through GUI also fails with the same error message.
Anoopambli - did you set FORWARD_SERVER="destserver:port" so that the forwarder knows where it is sending logs to?
Are your domain rights / account ok, members of local Admin Group etc (maybe you are domain admin ;-)?