Why did Agent splunk ended prematurely Windows Server 2012 R2?

[EFFE4]

Hi all,

I have a problem with installing splunk agent on windows 2012 R2 server.

I follow the installation via the wizard however the installation fails without returning error messages.

I have attempted to install the following versions without success:

• 9.0.0
• 8.2.7
• 7.2.0

Below are the errors present in the log file C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd-utility:

07-25-2022 11:46:10.287 +0200 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
07-25-2022 11:46:10.287 +0200 INFO ServerConfig - Host name option is "".
07-25-2022 11:46:10.318 +0200 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts
07-25-2022 11:46:11.522 +0200 ERROR LimitsHandler - Configuration from app=SplunkUniversalForwarder does not support reload: limits.conf/[thruput]/maxKBps
07-25-2022 11:46:11.522 +0200 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for limits (access_endpoints /server/status/limits/general): Bad Request
07-25-2022 11:46:11.522 +0200 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for server (http_post /replication/configuration/whitelist-reload): Application does not exist: Not Found
07-25-2022 11:46:11.522 +0200 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for web (http_post /server/control/restart_webui_polite): Application does not exist: Not Found
07-25-2022 11:46:11.522 +0200 WARN LocalAppsAdminHandler - User 'splunk-system-user' triggered the 'enable' action on app 'SplunkUniversalForwarder', and the following objects required a restart: default-mode, limits, server, web

Thank you in advance for the support,
Regards.

Fabio.

[EFFE4]

Hi @gcusello ,

Yes, on the server is present the antivirus, do you think that this is the problem?

Ciao,

Fabio.

[gcusello]

Hi @EFFE4,

I don't know, maybe it depends on the Antivirus, anyway try to temporary disable it and if the issue is still present open a ticket to Splunk Support.

Ciao.

Giuseppe

[gcusello]

Hi @EFFE4,

is there any protection system on your server: antivirus, or other?

Anyway, I hint to open a Case to Splunk Support.

Ciao.

Giuseppe