FWIW, happening here as well, with 9.2.0.1. Checked all The Things mentioned in that doc everyone keeps referencing, including those stanzas mentioned numerous times here. Another symptom of mine is that the ForwarderManager (deployer) doesn't appear in my monitored servers in the SplunkManager (aka Master). ... View more

additional: It appears the forwarder manager is servicing clients, but they are not being reflected in the GUI or at the commandline: [root@splunkdeployer ~]# /opt/splunk/bin/splunk list deploy-clients Splunk username: admin Password: Login successful, running command... No deployment clients have contacted this server. Go figure... More Googling... ... View more

Darn. Nope. All those conditions check out OK in my environment. New indexes are where they should be, it's a stand-alone deployment manager, etc.. ... View more

No, I haven't, thanks!  Missed this in the release notes... Will let you know how it works out. ... View more

did you ever get resolution on this? My deployment server stopped servicing clients -- start throwing this error. No firewall or selinux issues as suggested below... ... View more

Holy Cow, great stuff -- thanks! why, oh why, could Splunk not have had something like this...? ... View more

wow, definitely a case of "your mileage may differ"... this is just a small sample of these alerts here, and on the ones triggered by Splunk, they still seem to function OK: ADPClientService.exe, version: 4.1.38.0, time stamp: 0x62c69205 AUEPMaster.exe, version: 1910.24.6.725, time stamp: 0x5d39726f AdAutoUpdateSDK.dll, version: 0.0.0.0, time stamp: 0x61dc3463 AdskAccessServiceHost.exe, version: 1.27.0.4, time stamp: 0x61dc35ae AdskUpdateCheck.exe, version: 1.27.0.4, time stamp: 0x61dc3558 CcmProfiler.dll_unloaded, version: 5.0.9106.1000, time stamp: 0x642d9f3d FMEngine.dll, version: 19.2.2.234, time stamp: 0x60451558 KERNEL32.DLL, version: 10.0.17763.4720, time stamp: 0xa2ec4df3 KERNELBASE.dll, version: 10.0.19041.3393, time stamp: 0x6b4de7c9 OUTLOOK.EXE, version: 16.0.10402.20023, time stamp: 0x64ef06a7 smartscreenps.dll, version: 10.0.19041.3031, time stamp: 0x92650ce8 PDFMEngine.dll, version: 23.6.20320.0, time stamp: 0x64f8d26b RPCRT4.dll, version: 10.0.17763.4644, time stamp: 0x565f63ab RtkAudUService64.exe, version: 1.0.0.176, time stamp: 0x5c6f93ad VCRUNTIME140.dll, version: 14.16.27033.0, time stamp: 0x5d30eadf biwinrt.dll, version: 10.0.17763.2989, time stamp: 0x790cc0bc splunk-winevtlog.exe, version: 2304.1280.25713.15594, time stamp: 0x64713ec1 ... View more

I think this is all a "non issue" as it relates to Splunk.... read on:  if you search for this error as posted by the OP, you will see faults generated by Splunk. To illustrate, use this ugly query (don't do this at home, this for demonstration purposes only): index=*wineventlog "faulting" "*splunk*" HOWEVER, take off the "*splunk*" from this, and you'll see that hundreds of other apps are doing this too. I'm calling this a Windows issue, not a Splunk issue. 🙄   FWIW:  version 9.1.1. ... View more

100% -- this is causing all kinds of FUBAR in our organization. I get a half-dozen sales oriented announcements from Splunk -- but they couldn't be bothered to warn us about something that breaks all the forwarders? ... View more

Good point. I'm afraid if that works, it's still not a fix as we can't run processes with elevated privs... I'll still see about testing it though. ... View more

wow, almost two years and now answer? I'm getting this too, on about 383 different UF clients (out of about a1,000). I'm using the latest 9.0.4.0... ... View more

Thanks! That's it, for some reason that was commented out. # SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder ... View more

<heavy sigh> PS C:\Program Files\SplunkUniversalForwarder\bin> .\btool.exe list inputs --debug SPLUNK_HOME must be set. Stopping.   Never a dull moment... ... View more

Thanks, guys. Guess I need to learn to use btool... I know, I know, I've just been lazy... Grazie. ... View more

Oh, I'm sure it works for you, but we have an isolated network (no direct connection to the Internet). I've griped at Splunk for years about having something local -- it appears local because the link is:   https://splunk:8000/en-US/help?location=app.splunk_monitoring_console.monitoringconsole_configure But docsCheckerBaseURL points to https://quickdraw.splunk.com/help  -- that's the only thing that tells me it's going "online" -- when I can't. So, I'm assuming it's trying to go to https://quickdraw.splunk.com/help?location=app.splunk_monitoring_console.monitoringconsole_configure But that doesn't work either... (on a system in our DMZ). I just gave up on it years ago. They either need to provide local documentation or at least provide the link it's actually trying to hit so I can cut-n-paste it somewhere else. ... View more

Well, while I'm not too keen on answers consisting of links to DL;DR pages, I did find the solution. Thanks! The answer was to add:   version="1.1"  at the top. example, in my case: <form  version="1.1"   theme="dark"> And, FWIW, I just noticed that in a dashboard I created from scratch after upgrading to 9.0.01 has this automagically inserted at the top: <form version="1.1"> ... View more

This has never worked for me (since version 4.0). I always assumed it was because we're on an isolated enclave (no Internet) regardless of the URL shown. Well, I'm on 9.0.0.1 now and it's still not working. Thought I'd try one more time... nope. I can't believe something so simple has *never* been fixed by Splunk. Going back to giving up on it again. ... View more

uh, ya, what Greg said -- what/where is the "root node"? (I've been or admin/dev on our Splunk infrastructure since v4.0, and I don't' follow you.). Karma points for you if you don't answer cryptically or with another link to a doc that doesn't answer the question... ... View more

Think I just noticed part of the problem, maybe this post will still help somebody out there if they run across it (otherwise I'd delete it out of embarrassment, 😉 The data in question has a typo in the timestamp, a comma. Even though it's being extracted OK into "_time", it appears that it's enough to jack with the other "date_" extractions. i.e.:  2022-07-20 13:07:51,352 ... View more