Deployment Architecture

unable to start splunkforwarder from services.msc 1067 error -- Build - 6.0.3

dipinp
New Member

windows could not start splunkforwarder service on local computer
error - 1067 - The process terminated unexpectedly
splunkd logs , Where do I look for lock files , How to solve this on windows
10-12-2019 09:59:33.615 -0700 FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting.
10-12-2019 10:00:34.568 -0700 WARN loader - Sleep 10 sec, waiting for config lock.
10-12-2019 10:00:44.584 -0700 WARN loader - Sleep 10 sec, waiting for config lock.
10-12-2019 10:00:54.600 -0700 WARN loader - Sleep 10 sec, waiting for config lock.
10-12-2019 10:01:04.615 -0700 WARN loader - Sleep 10 sec, waiting for config lock.
10-12-2019 10:01:14.631 -0700 WARN loader - Sleep 10 sec, waiting for config lock.
10-12-2019 10:01:24.647 -0700 WARN loader - Sleep 10 sec, waiting for config lock.
10-12-2019 10:01:34.662 -0700 FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting.
10-12-2019 10:01:51.147 -0700 WARN loader - Sleep 10 sec, waiting for config lock.
10-12-2019 10:02:01.163 -0700 WARN loader - Sleep 10 sec, waiting for config lock.

Tags (1)
0 Karma

ivanreis
Builder

As mentioned on the previously post by richgalloway, you have to check the error messages on file splunkd_stderr.log.

Check if the user that you are installing the UF client has the access granted to start the service
you can either use the windows system local account or domain account where the user has privilege access to start splunk service
Remove the UF client from this server.
Verify if you have any local server police from anti-virus or other software that monitores the server that can prevent splunk service to be started.
Also check the windows logs on the server, because if there is any problem with permissions, there is potential the error will be there
Install the UF client again on a sandbox server where you can run your troubleshooting or either test the different windows accounts who has access to process changes on the system.

https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/InstallaWindowsuniversalforwarderfro...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What does it say in splunkd_stderr.log?

---
If this reply helps you, Karma would be appreciated.
0 Karma

dipinp
New Member

Hey,

I don't have this log file under C:\Program Files\SplunkUniversalForwarder\var\log\splunk

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...