Monitoring Splunk

Windows could not start the Splunkd (or SplunkForwarder) service on Local Computer...cannot find file specified

Strype
Path Finder

This may have already been posted but I couldn't find it and I burnt up about 2-3 hours scratching my head...

After a service restart, if you get the following error message:
"Windows could not start the Splunkd service on Local Computer. Error 2: The system cannot find the file specified."

Answer can be found below. I hope it helps someone save some time.

1 Solution

Strype
Path Finder

Windows key + r Type regedit HKLM > System > CurrentControlSet > services > Splunkd (or SplunkForwarder) If ImagePath has quotes in it, delete them and start the service.

View solution in original post

Strype
Path Finder

Windows key + r Type regedit HKLM > System > CurrentControlSet > services > Splunkd (or SplunkForwarder) If ImagePath has quotes in it, delete them and start the service.

View solution in original post

david_pinon
New Member

This didn't work for me either and I also receive:

Error 1067: The process terminated unexpectedly.

0 Karma

pparkerntx99
Explorer

The answer did not work when I tried it

0 Karma

kmattern
Builder

What do you do when DoD IA policies flag this as a possible security violation and require the quotes?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!