Getting Data In

Why am I getting "Service 'splknetdrv' could not be stopped! Error = 1062" in splunkd.log after restarting Windows universal forwarder?

dlpco
Path Finder

I am finding the following error in the splunkd.log of the forwarder running on a Windows machine after restarting the forwarder:

10-02-2014 16:57:49.603 -0700 ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-netmon.exe" splunk-netmon - NetmonStopDriver - Service 'splknetdrv' could not be stopped!  Error = 1062

rovechkin
Explorer

this can happen is the driver was busy processing network packets. Eventually it will be shut down by Windows SCM. Let me know if this is persistent issue.

0 Karma

dstaulcu
Builder

I get this problem too.. on many servers.. some very busy, some not-so-busy

0 Karma

rovechkin
Explorer

Thanks for reporting! We will take a look at the issue, whoever it is probably benign - the driver might be just a bit busy and will eventually be shut down.

0 Karma

dlpco
Path Finder

Sorry - the backslashs in the path were stripped out for some reason.

0 Karma

musskopf
Builder

Did you find a solution? I'm trying to enable netmon over here and getting the same error... my Splunk UNF is 6.1.1

dlpco
Path Finder

I never did get an answer, I updated to 6.2.1 and installed the indexer on LINUX and issue was not encountered again.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...