Hello, I am having a hard time with the Splunk Universal Forwarder agent v9.1.1. Got it installed in 100+ servers and it starts and talks to the deployment server , then when I push some configs, it restarts and never comes back. To make it start again, the windows admin had to remove the credentials of Splunk user from the host. I tried installing the agent in multiple ways and even tried using virtual account and experienced the same results
Default installation :
msiexec.exe /i splunkforwarder-9.1.1-64e843ea36b1-x64-release.msi AGREETOLICENSE=yes DEPLOYMENT_SERVER=some_url:8089 SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet
Using Virtual account without password:
msiexec.exe /i splunkforwarder-9.1.1-64e843ea36b1-x64-release.msi AGREETOLICENSE=yes DEPLOYMENT_SERVER=some_url:8089 SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 SPLUNKUSERNAME=splunkfwd USE_VIRTUAL_ACCOUNT=1 /quiet
Using Virtual account with password:
msiexec.exe /i splunkforwarder-9.1.1-64e843ea36b1-x64-release.msi AGREETOLICENSE=yes DEPLOYMENT_SERVER=some_url:8089 SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 SPLUNKUSERNAME=splunkfwd SPLUNKPASSWORD=some_password USE_VIRTUAL_ACCOUNT=1 /quiet
Any thoughts on what could be the issue? Splunk log does not show any anything. And just to add this this, it works fine in some hosts (~5) without any issues
