in additional to yannK answer. remove the following pid files from $SPLUNK_HOME/var/run/splunk if they exist - splunkd.pid.corrupt - conf-mutator.pid and start splunk/splunkforwarder ... View more