Does not start splunk forwarder service

[paola92]

I have installed splunk forwarder for a windows servers and the service must be initialized when the server starts but some times the service doesn't start so I need to know how to see why the service doesn't start or how I must configure the service.

[gcusello]

Hi paola92
three checks:

• at first,verify if the Splunk Universal Forwarder version you're using is supported for that Windows Operative System version.
• then start Splunk using CLI instead of Windows Services, so you can see the start-up messages;
• then search error messages in $SPLUNK_HOME\var\log\splunk\splunkd.log.

Usually using CLI you reach to display start-up errors (e.g. memory or grants problems).

Then share these messages to better understand your problem.

If this problem is about an active customer, you can also open a case to Splunk Support and be supported by them.

Ciao.
Giuseppe

[ktn01]

Hello,

Do you check the content of "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log" ?

Regards
Christian