Getting Data In

New install fails to start - Splunk Universal Forwarder

nb41n
Engager

I have successfully installed and configured Splunk and forwarders on OSX and Ubuntu systems but I have two Ubuntu systems where new installs fail to start and generate no error.

/opt/splunkforwarder$ sudo ./bin/splunk start 

....fails silently and appears not to write any error to logs. What is the process for debugging this?

Neil

Tags (3)
0 Karma

lukejadamec
Super Champion

In the splunk/var/run/splunk folder look for a pid or lock file. If it is there, delete it and try to start splunk again.

nb41n
Engager

Thanks again. I don't believe Splunk is getting to the point of writing to any file as I don't get the licence screen that I would expect for an initial start. I certainly cannot find any output. It feels like a permissions problem but given I am starting Splunk as root that seems odd. Given Splunk is working on other similar servers locally I am convinced this is a local problem rather than a Splunk problem. I'll post the outcome when I can get it figured.

0 Karma

lguinn2
Legend

What log files do you get, if any? Is there a permissions problem that would prevent Splunk from writing/creating log files? If this is the case, I am truly surprised that Splunk does not give an error message...

Also, I would open a Support ticket at this point.
http://www.splunk.com/support

0 Karma

nb41n
Engager

Thanks for the response. I thought this had pointed me in the right direction as the log file mentioned in the docs did not exist. However, after 'touch'ing the log file and attempting to restart (both with and without --debug) still no joy.

0 Karma

lguinn2
Legend

Well, I have never had to do this - I've always found something in the logs 🙂

But you can start Splunk in debug mode

/opt/splunkforwarder$ sudo ./bin/splunk start --debug

More info in the docs here

I don't recommend this as a general debugging tool, but in this specific case it might help since you are getting no information at all. In "debug mode", I don't think Splunk will do much useful work!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...