Deployment Architecture

Does not start splunk forwarder service


I have installed splunk forwarder for a windows servers and the service must be initialized when the server starts but some times the service doesn't start so I need to know how to see why the service doesn't start or how I must configure the service.

Tags (1)
0 Karma


Hi paola92
three checks:

  • at first,verify if the Splunk Universal Forwarder version you're using is supported for that Windows Operative System version.
  • then start Splunk using CLI instead of Windows Services, so you can see the start-up messages;
  • then search error messages in $SPLUNK_HOME\var\log\splunk\splunkd.log.

Usually using CLI you reach to display start-up errors (e.g. memory or grants problems).

Then share these messages to better understand your problem.

If this problem is about an active customer, you can also open a case to Splunk Support and be supported by them.


0 Karma

Path Finder


Do you check the content of "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log" ?


0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...