unable start forwarder

[st88]

i can't start forwarder i take this error:

Starting splunk server daemon (splunkd)...
SplunkForwarder: Unable to start the service: Access is denied.

[SamHTexas]

Not sure if the management port you have listed above 9089 is correct. I have used 8089 for the longest time.

[richgalloway]

Verify the files are owned by the right user. Confirm you are starting Splunk as that user.

For more suggestions, tell us more about the problem.  Is this a fresh installation?  Has it ever worked?  What platform?  How was the forwarder installed?  How are you trying to start it?

[st88]

How can i verify the files are owned by the right user and start splunk from this user?

[richgalloway]

Yeah, that was more of a Linux answer than a Windows answer.  Sorry about that.

I wonder if maybe the virtualization is causing the problem.  Have you tried installing the forwarder directly on the host system?  Why not use a Linux VM?

[st88]

Yes it is first installation on windows virtual box on windows host, also it has never worked. I installed from gui installer and i am truing to start by splunk start or splunk restart on command line and i get the following:

Checking prerequisites...
        Checking mgmt port [9089]: open
        Checking conf files for problems...
        Done
        Checking default conf files for edits...
        Validating installed files against hashes from 'C:\Program Files\SplunkUniversalForwarder\splunkforwarder-8.2.0-e053ef3c985f-windows-64-manifest'
        All installed files intact.
        Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
SplunkForwarder: Unable to start the service: Access is denied.

[splnkuserav]

I am seeing same error.  Did this ever get resolved?

Thanks!