Deployment Architecture

Why is a Splunk forwarder creating a zombie process when starting via systemd?

New Member

I have installed version 7.2.4 of the Splunk Forwarder from the deb package on a x64 Ubuntu 18.04.1 LTS system. After the install, I used this command to generate the systemd unit file.

/opt/splunkforwarder/bin/splunk enable boot-start -user splunk --accept-license --no-prompt --answer-yes

The service starts and runs without any issue, but I'm always left with a zombie process on my system. If I stop the SplunkForwarder service, it goes away, and comes back when it's started again.

splunk 29920 0.0 0.0 0 0 ? Z 10:55 0:00 [systemctl] *

Does anyone know a way to get rid of this?

0 Karma

New Member

I've upgraded to 7.2.6 and it looks like the issue is resolved.

0 Karma

New Member

thanks ray... but why its coming, i didn't see any documentation from splunk GCS team, seems they even didn't bother about it...

0 Karma


Were you able to sort it out? I'm facing the exact same issue

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...