Deployment Architecture

Does not start splunk forwarder service

paola92
Explorer

I have installed splunk forwarder for a windows servers and the service must be initialized when the server starts but some times the service doesn't start so I need to know how to see why the service doesn't start or how I must configure the service.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi paola92
three checks:

  • at first,verify if the Splunk Universal Forwarder version you're using is supported for that Windows Operative System version.
  • then start Splunk using CLI instead of Windows Services, so you can see the start-up messages;
  • then search error messages in $SPLUNK_HOME\var\log\splunk\splunkd.log.

Usually using CLI you reach to display start-up errors (e.g. memory or grants problems).

Then share these messages to better understand your problem.

If this problem is about an active customer, you can also open a case to Splunk Support and be supported by them.

Ciao.
Giuseppe

0 Karma

ktn01
Path Finder

Hello,

Do you check the content of "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log" ?

Regards
Christian

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...