This topic lists known issues that are specific to the universal forwarder. For information on fixed issues, see Fixed issues.
Universal forwarder issues
|Unable to install or upgrade to Splunk Universal Forwarder version 9.1.3
Install UF while passing the following feature flag:
msiexec.exe /i $SPLUNK_MSI_PACKAGE USE_LOCAL_SYSTEM=1
|Splunk forwarder crashing on AIX when failed to connect to indexers
|Restart is needed when AWS access key pairs rotate (w/o grace period) or other S3 config settings for Ingest Actions become invalid
|Warning appears in the universal forwarder whenever any spl command is run: Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk /opt/splunkforwarder". This warning is expected and will not affect functionality.
|Ownership of files mentioned in manifest file is splunk:splunk instead of root:root after enabling boot start as root user for initd
When changing UF user, manually chown SPLUNK_HOME to the new user, including first time install/upgrade, or manually enable boot-start.
|System Introspect App fails when universal forwarder is installed at non-admin user
Troubleshoot the universal forwarder
This documentation applies to the following versions of Splunk® Universal Forwarder: 9.1.2