Getting Data In

How to resolve error "ERROR IndexConfig - stanza=perfmon Required parameter=tstatsHomePath not configured" when starting the indexer?

rakeshroberts
New Member

When using Windows 2016 Universal Forwarder 6.6.1, I'm running into issues with starting indexer. splunkd log indicates the following

06-29-2017 11:42:32.517 -0500 INFO  loader - Initializing from configuration
06-29-2017 11:42:32.517 -0500 WARN  IndexerService - Indexer was started dirty: splunkd startup may take longer than usual; searches may not be accurate until background fsck completes.
06-29-2017 11:42:32.517 -0500 ERROR IndexConfig - stanza=perfmon Required parameter=tstatsHomePath not configured
06-29-2017 11:42:32.517 -0500 FATAL IndexerService - Cannot load IndexConfig: stanza=perfmon Required parameter=tstatsHomePath not configured
06-29-2017 11:42:32.517 -0500 ERROR IndexConfig - stanza=perfmon Required parameter=tstatsHomePath not configured
0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

The message is unrelated to UF
There's some problem in your perfmon index configuration on your indexer

How was your perfmon index created ?

you can :
- verify that indexes.conf from default hasn't been changed/removed
- verify any indexes.conf in app or system
- do a splunk cmd btool indexes list perform --debug and compare it with splunk cmd btool indexes list main, check for the tstatsHomePath because splunk complain it's missing.
- delete and recreate that perfmon index if necessary

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

Hi @rakeshroberts,

You may want to take a look at this documentation regarding compatibility between forwarders and indexers:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Compatibilitybetweenforwardersandindexe...

It may answer your question.

0 Karma

rakeshroberts
New Member

Tried a Fresh install of the Universal forwarder

Noticed an entry int he splunkd-utility.log

07-03-2017 10:35:42.546 -0500 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for limits (access_endpoints /server/status/limits/general): Bad Request
07-03-2017 10:35:42.546 -0500 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for server (http_post /replication/configuration/whitelist-reload): Application does not exist: Not Found
07-03-2017 10:35:42.546 -0500 ERROR ApplicationUpdater - Error reloading SplunkUniversalForwarder: handler for web (http_post /server/control/restart_webui_polite): Application does not exist: Not Found

07-03-2017 10:36:00.719 -0500 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
07-03-2017 10:36:00.734 -0500 INFO ServerConfig - Host name option is ""

in the splinkd.log
07-03-2017 10:36:08.578 -0500 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

07-03-2017 10:39:49.321 -0500 ERROR IndexConfig - default index disabled - quit!
07-03-2017 10:39:49.321 -0500 FATAL IndexerService - Cannot load IndexConfig: default index disabled - quit!
07-03-2017 10:39:49.321 -0500 ERROR IndexConfig - default index disabled - quit!

0 Karma

rakeshroberts
New Member

I've been told that the splunk universal forwarder should be the same version of the server that its trying to connect to. Is this the case?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...