Getting Data In

On Windows, Forwarder crash - splunk_wmi.exe

New Member


I have installed the Forwarder on windows, and Forwarder works well for a period of time.
But, forwarder crashed suddenly with error log:
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" Clean shutdown completed.

What's the reason for this crash? How to avoid it happen again? Any guidance or suggestions will be highly appreciated! Thanks!

0 Karma


Hi @wangzhaoyu,
I had a similar problem in several projects.
One of them, it was a memory problem that I solved widening RAM.
Other times it was a problem on an old Universal Forwarder that Splunk Support solved upgrading UF.
If it continues, open a ticket to Splunk Support.


0 Karma

New Member

Hi @gcusello ,

thank you sooo much
we will check the memory and UF version 🙂

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!