Getting Data In

Help with installing two universal forwarders on the same Windows box - service shutting down on second install

pfabrizi
Path Finder

I need to install 2 separate universal forwarders on the same Windows box. I have the install built, one via msi and the other via scripted process. On one install the service shuts down. I connected both services to 1 deployment server and that seemed fine, when I change the deployment client to point to the other deployment server the service also shuts down. Here is the log where you see it removing the and then splunkd restarting. ??

09-20-2017 12:29:54.412 -0400 INFO DeployedApplication - Removing app=Splunk_TA_windows at='C:\program files\splunk-PI\etc\apps\Splunk_TA_windows'
09-20-2017 12:29:54.537 -0400 WARN BundlesUtil - C:\program files\splunk-PI\etc\apps\SplunkUniversalForwarder\metadata\local.meta already exists but with different casing: C:\Program Files\splunk-PI\etc\apps\SplunkUniversalForwarder\metadata\local.meta
09-20-2017 12:29:54.537 -0400 WARN BundlesUtil - C:\program files\splunk-PI\etc\system\metadata\local.meta already exists but with different casing: C:\Program Files\splunk-PI\etc\system\metadata\local.meta
09-20-2017 12:29:54.552 -0400 WARN BundlesUtil - C:\program files\splunk-PI\etc\apps\learned\metadata\local.meta already exists but with different casing: C:\Program Files\splunk-PI\etc\apps\learned\metadata\local.meta
09-20-2017 12:29:54.552 -0400 WARN DC:DeploymentClient - Restarting Splunkd...
09-20-2017 12:29:54.552 -0400 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.210.147.150_8090_L74B00-PC0ETLVM.prod.travp.net_L74B00-PC0ETLVM_22D4D347-CE64-48BC-A1F0-352E78032799
09-20-2017 12:29:55.956 -0400 INFO PipelineComponent - Performing early shutdown tasks
09-20-2017 12:29:55.956 -0400 INFO loader - Shutdown HTTPDispatchThread
09-20-2017 12:29:55.956 -0400 INFO ShutdownHandler - Shutting down splunkd
09-20-2017 12:29:55.956 -0400 INFO ShutdownHandler - shutting down level "ShutdownLevel_Begin"
09-20-2017 12:29:55.956 -0400 INFO ShutdownHandler - shutting down level "ShutdownLevel_FileIntegrityChecker"

0 Karma
1 Solution

MousumiChowdhur
Contributor

Hi,

Have you created two different folders under Program Files and installed Splunk under those? Also, have you used two different ports for the two different instances?

Thanks.

View solution in original post

0 Karma

MousumiChowdhur
Contributor

Hi,

Have you created two different folders under Program Files and installed Splunk under those? Also, have you used two different ports for the two different instances?

Thanks.

0 Karma

pfabrizi
Path Finder

I think I got past this issue. I was trying to test that both services (reporting to different deployment servers) can co-exist on the same box and that a deployment push to one will not impact the other service. We have multiple instances of SPLUNK managed by different area's, so we don't want them impacting each other.

0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...