Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to restart a universal forwarder remotely ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We are facing a few issues whereour endpoints (clients) may have the Splunk service stopped.
Can we force a restart of the Universal forwarder (agent) "splunk service" or "splunk" from our deployment server?
Currently, we are asking the support team of the respective application team to do it for us, but would be great if we can manage the agents ourselves. (BTW the agents have local accounts in the clients)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do not know of a way to force restart a deployment client once it already stopped. After all, if the service is stopped, it can’t connect to the deployment server in the first place.
I used to work in an environment where we monitored for critical services stopping in Splunk, the Splunk service being one of them. Perhaps it would be a good idea to investigate why the service is stopping to verify nothing malicious is occurring. Should be Event ID 7036. You could do what we did and use a powershell script to restart the service should it stop. We ran the script in the background as a scheduled task every 15 minutes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi koshyk,
No you cannot if your Forwarder is stopped!
you can restart a Forwarder only if it runs and you deploy a TA on this Forwarder.
probablu the only way is a remote script shell.
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do not know of a way to force restart a deployment client once it already stopped. After all, if the service is stopped, it can’t connect to the deployment server in the first place.
I used to work in an environment where we monitored for critical services stopping in Splunk, the Splunk service being one of them. Perhaps it would be a good idea to investigate why the service is stopping to verify nothing malicious is occurring. Should be Event ID 7036. You could do what we did and use a powershell script to restart the service should it stop. We ran the script in the background as a scheduled task every 15 minutes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
+1 thanks for the tip of powershell script. hopefully will get more ideas from other people
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
