Splunk® Universal Forwarder

Forwarder Manual

This documentation does not apply to the most recent version of Splunk® Universal Forwarder. For documentation on the most recent version, go to the latest release.

Known issues

This topic lists known issues that are specific to the universal forwarder. For information on fixed issues, see Fixed issues.

Universal forwarder issues

Date filed Issue number Description
2025-01-24 SPL-269613, SPL-273376, SPL-273377 Issue with sslCommonNameToCheck configuration post upgrade to 9.3.2

Workaround:
Modified the server.conf configuration of all clients with a comma at the end of the sslCommonNameToCheck to force Splunk to concatenate correctly. Then the issue got mitigated.

sslCommonNameToCheck = qual-clustermanager.noe.zst.enedis.fr, qual-enclaves.noe.zst.enedis.fr, qual-forwarder-generic.noe.zst.enedis.fr, qual-heavyforwarder.noe.zst.enedis.fr, qual-indexer.noe.zst.enedis.fr, qual-searchhead.noe.zst.enedis.fr, qual-utility.noe.zst.enedis.fr,

2024-09-27 SPL-263518 Upgrade removes group=per_(source|sourcetype|index|host)_thruput in metrics.log for universalforwarders.

Workaround:
------ON UF ONLY-------

in default-mode.conf add following line

#Turn off a processor
[pipeline:indexerPipe]
disabled_processors= index_thruput, indexer, indexandforward, latencytracker, diskusage, signing,tcp-output-generic-processor, syslog-output-generic-processor, http-output-generic-processor, stream-output-processor, s2soverhttpoutput, destination-key-processor



2024-04-19 SPL-254532, SPL-265719, SPL-265720, SPL-265721, SPL-265722, SPL-265723, SPL-265724, SPL-265725, SPL-265726, SPL-265892, SPL-265908 UF 9.1.2 Windows Security events stop forwarding when Windows event log service is restarted

Workaround:
Restart the UF
2022-08-17 SPL-228646, SPL-228645 Restart is needed when AWS access key pairs rotate (w/o grace period) or other S3 config settings for Ingest Actions become invalid
2022-06-23 SPL-226019 Warning appears in the universal forwarder whenever any spl command is run: Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk /opt/splunkforwarder". This warning is expected and will not affect functionality.
2022-03-23 SPL-221239 System Introspect App fails when universal forwarder is installed at non-admin user
Last modified on 15 April, 2025
Troubleshoot the universal forwarder   Fixed issues

This documentation applies to the following versions of Splunk® Universal Forwarder: 9.3.2

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters