The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Previous Topic: Using Splunk to see which companies (i.e. potential prospects) are visiting a site | Next Topic: How do I exclude lines containing "foo bar baz" before they are indexed?
Posts 1–10 of 29
Hello,
I've a problem with the windows installer.
Ive instaled Splunk on win2000 and ond win XP. after installation and service splunkd where started, the service brake down.
the service strarts at system user and i dont know wat is wrong.
whenn i try to start manualy the system starts and a secound later ist stops.
whats the problem??? what is wrong??? is there an older release anywhere whitch i can try??
sorry for the bad english
LG S. Gröger
So far, I've only installed Splunk for Windows on Server 2003. I was able to make it crash with the following Application event log error:
Faulting application splunkd.exe, version 0.0.0.0, faulting module splunkd.exe, version 0.0.0.0, fault address 0x0033ec40.
I did this by running Splunk as a local user that was not SYSTEM. Running under the SYSTEM user has been stable for me.
I found that the installer incorrectly sets the user password ( or doesnt grant the logon as service right) If you using the services.msc to reset the username the 2 services run under it works fine.
I can reproduce this, I will file a bug.
I have the same problem under windows XP and Windows 2003
I am checking up on the bug I filed, I will post back when I know the status.
Hey Guys,
one year ago I did a big evaluation for a german company of Splunk 2 in Debian envronment . We decided not to use it, due to its instable behaviour.
Now one year later unfortunatly I see nothing changed, neither with the Version 3, nor with the Windows (that I really looked forward too) release. I really like the idea of Splunk, but get your stuff working or you can change your slogan to "crashesls in less than 5 minutes".
Sorry, that this post is worthless for finding a solution, but I hope to kick someones butt in order to have a working Splunk someday.
Hi everyone,
I'm the cto and co-founder of splunk. Thanks for letting us know about your issues as its impossible to improve the product without the feedback.
Its important to us because we are still a small(ish) company that tries to build software for a huge range of platforms and deployment configurations. We have users that want it to run seamlessly with a 5 minute install on a mac laptop and others that want it to work in multiple data centers running distributed splunk on 100's of solairs/linux/aix/windows servers. We do our best to test a huge range of configurations/environments but then once in awhile there is something about a customers environment or data that somehow causes us problems. Most of the time there is a work around. If not, we kick out maintenance releases every few weeks and if we know of a crash its fixed immediately. The trick is that we need to know about the problems - this forum or the support@splunk.com email address are our lifeline to real customer issues.
TheGambler, sorry you had a poor experience. Its not the norm but I'm sure it happens. When it does if we know about it we can work around it and fix it so others dont have the problem. I'd be interested in hearing more about your experience - drop me a line erik at splunk dot com.
Linsash, is it possible you did as jploine said in the 3rd post? This is a known bug and will be fixed in a few weeks. If not, then it would be good to get more info.
If any of you run into other problems or just have suggestions on how to improve the product / user experience please let us know. It is really the only way we can build the best possible product.
Regards,
erik
[Revised on Wed, 26 Mar 2008 18:34:49 -0700]
What erik said.
Also, on the password bug I heard "set for 3.2.3", which as erik mentioned will be out in a few weeks.
linsash and jplonie, setting user credentials via the installer for an existing user should work fine. Make sure that the user part has also the domain or computer name eg: "//my_computer\user". The installer verifies the credentials, so if they are wrong, the installer will fail.
Installing as a LocalSystem user should by pass all the above.
If you decided to create a user on fly with the installer, that new user context gets applied to Splunk services and Splunk services are own by it, but the new user context doesn't not take affect until you go to the service manager and reapply the new context to the Splunk services again. This is a known issue and we're looking into it.
Cheers,
Ledio
Windows Splunker.
[Revised on Thu, 27 Mar 2008 17:46:49 -0700]