SPLUNK Universal Forwarder on Windows Server Core

[KevinMurray]

I have several domain controllers, running the core version of Windows Server, reporting these errors in the splunkd logs:

01-30-2018 03:36:50.596 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - startDriver - StartService failure for splunkdrv! Error = 201-30-2018 03:36:50.596 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - WinRegistryMonitor::StartDriver: Unable to install driver.01-30-2018 03:36:50.596 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - stopDriver - Service 'splunkdrv' could not be stopped!  Error = 1062
01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - GetServiceHandle - OpenService failure for 'SplunkMonitorNoHandle'!  Error = 1060
01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - runWinMonitorNoHandleMon: Could not connect to filter driver 0x80070002
01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - DisplayError: %01-30-2018 03:36:51.002 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - GetServiceHandle - OpenService failure for 'SplunkMonitorNoHandle'!  Error = 1060

I would appreciate any help resolving these. I'm assuming since it is the "core" O/S, there is something locked down or missing that is required for SPLUNK to gather the data.

[dbot2001]

Run "Repair' or reinstall the Splunk Application

[ansif]

For me a reboot helped.

You can also check the user permissions.