Getting Data In

Introspecting scheme=WinEventLog: killing process, because executing it took too long

thy666
Engager

I met an error to start collecting WinEventLog when starting Universal Forwarder 6.6.2 on Windows Server 2008R2(x64). The streamfwd.exe worked well on the same host. Do you have same situation, and idea?

10-29-2017 19:38:05.421 +0900 ERROR ModularInputs - Unable to initialize modular input "WinEventLog" defined in the system context: Introspecting scheme=WinEventLog: script running failed (exited with code 0).
10-29-2017 19:38:05.156 +0900 ERROR ModularInputs - Introspecting scheme=WinEventLog: killing process, because executing it took too long (over 30000 msecs).

mbadhusha_splun
Splunk Employee
Splunk Employee
  1. Disable all other stanzas. Leave only the affected stanza enabled.
  2. Run the input from the command line to see if it can read events. $ splunk cmd splunkd print-modinput-config WinEventLog | splunk-WinEvtLog.exe
  3. Remove the checkpoint file (make a copy of it first) and restart Splunk service.
  4. Run the input again to see if it can read events.

If this is because of the checkpoint file, step 2 will not produce events. Step 4 should produce events.

On the UF, run command prompt as administrator
Navigate to $SPLUNK_HOME\bin
Run the below two commands,

$ set SPLUNK_HOME="c:\program files\SplunkUniversalForwarder"

$ splunk cmd splunkd print-modinput-config WinEventLog

You can consider upgrading the affected Splunk UF's as well.

Cheers!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...