How to resolve error "ERROR IndexConfig - stanza=perfmon Required parameter=tstatsHomePath not configured" when starting the indexer?

[rakeshroberts]

When using Windows 2016 Universal Forwarder 6.6.1, I'm running into issues with starting indexer. splunkd log indicates the following

06-29-2017 11:42:32.517 -0500 INFO  loader - Initializing from configuration
06-29-2017 11:42:32.517 -0500 WARN  IndexerService - Indexer was started dirty: splunkd startup may take longer than usual; searches may not be accurate until background fsck completes.
06-29-2017 11:42:32.517 -0500 ERROR IndexConfig - stanza=perfmon Required parameter=tstatsHomePath not configured
06-29-2017 11:42:32.517 -0500 FATAL IndexerService - Cannot load IndexConfig: stanza=perfmon Required parameter=tstatsHomePath not configured
06-29-2017 11:42:32.517 -0500 ERROR IndexConfig - stanza=perfmon Required parameter=tstatsHomePath not configured

[maraman_splunk]

The message is unrelated to UF
There's some problem in your perfmon index configuration on your indexer

How was your perfmon index created ?

you can :
- verify that indexes.conf from default hasn't been changed/removed
- verify any indexes.conf in app or system
- do a splunk cmd btool indexes list perform --debug and compare it with splunk cmd btool indexes list main, check for the tstatsHomePath because splunk complain it's missing.
- delete and recreate that perfmon index if necessary

[aaraneta_splunk]

Hi @rakeshroberts,

You may want to take a look at this documentation regarding compatibility between forwarders and indexers:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Compatibilitybetweenforwardersandindexe...

It may answer your question.

[rakeshroberts]

Tried a Fresh install of the Universal forwarder

Noticed an entry int he splunkd-utility.log

07-03-2017 10:35:42.546 -0500 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for limits (access_endpoints /server/status/limits/general): Bad Request
07-03-2017 10:35:42.546 -0500 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for server (http_post /replication/configuration/whitelist-reload): Application does not exist: Not Found
07-03-2017 10:35:42.546 -0500 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for web (http_post /server/control/restart_webui_polite): Application does not exist: Not Found

07-03-2017 10:36:00.719 -0500 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
07-03-2017 10:36:00.734 -0500 INFO ServerConfig - Host name option is ""

in the splinkd.log
07-03-2017 10:36:08.578 -0500 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

07-03-2017 10:39:49.321 -0500 ERROR IndexConfig - default index disabled - quit!
07-03-2017 10:39:49.321 -0500 FATAL IndexerService - Cannot load IndexConfig: default index disabled - quit!
07-03-2017 10:39:49.321 -0500 ERROR IndexConfig - default index disabled - quit!

[rakeshroberts]

I've been told that the splunk universal forwarder should be the same version of the server that its trying to connect to. Is this the case?