This documentation does not apply to the most recent version of Splunk® Universal Forwarder.
For documentation on the most recent version, go to the latest release.
Known issues
This topic lists known issues that are specific to the universal forwarder. For information on fixed issues, see Fixed issues.
Universal forwarder issues
| Date filed | Issue number | Description |
|---|---|---|
| 2024-04-19 | SPL-254532, SPL-265723, SPL-265724, SPL-265725, SPL-265908, SPL-265719, SPL-265720, SPL-265721, SPL-265722, SPL-265726, SPL-265892 | UF 9.1.2 Windows Security events stop forwarding when Windows event log service is restarted Workaround: Restart the UF |
| 2022-08-17 | SPL-228646, SPL-228645 | Restart is needed when AWS access key pairs rotate (w/o grace period) or other S3 config settings for Ingest Actions become invalid |
| 2022-06-23 | SPL-226019 | Warning appears in the universal forwarder whenever any spl command is run: Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk /opt/splunkforwarder". This warning is expected and will not affect functionality. |
| 2022-06-06 | SPL-225379 | Ownership of files mentioned in manifest file is splunk:splunk instead of root:root after enabling boot start as root user for initd Workaround: When changing UF user, manually chown SPLUNK_HOME to the new user, including first time install/upgrade, or manually enable boot-start. |
| 2022-03-23 | SPL-221239 | System Introspect App fails when universal forwarder is installed at non-admin user |
Last modified on 12 November, 2024
| Troubleshoot the universal forwarder | Fixed issues |
This documentation applies to the following versions of Splunk® Universal Forwarder: 9.1.7
Download manual
Feedback submitted, thanks!