Windows 7 32-bit install of Splunk 6

[rroberts]

Getting this error message after new install:

"Unable to initialize modular input "MonitorNoHandle" defined in the system context: Introspecting scheme=MonitorNoHandle: script running failed (exited with code 255)."

However splunk seems to be running fine.

[wcolgate_splunk · Accepted solution]

Would you be willing to supply a little more information?

Is the handle-less driver installed? You can check from a cmd shell:

$ sc query SplunkMonitorNoHandle

If it is not installed, one can re-install it using the .inf file in the splunk installation tree (its in the bin directory). You can do this from the cmd shell: (note I've seen rundll32 only seem to like a full path of the .inf file...):

rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 c:\program files\splunk\bin\SplunkMonitorNoHandleDrv-vista.inf

(Note I explicitly selected the "vista" driver).

If you don't plan on ever using the file-handle-less modular input, you can just skip all of this and leave it as is. There is no hrm in letting it fail on start up.

[rroberts]

Don't plan on using file-handle-less modular input so I'll ignore the message. By the way, sc query SplunkMonitorNoHandle reports:
SERVICE_NAME: SplunkMonitorNoHandle
TYPE: 2 FILE_SYSTEM_DRIVER
STATE: 1 STOPPED
WIN32_EXIT_CODE: 1077 (0x435)