This happened to me when I was forced to change the password of the machine. Apparently, the password change wasn't propagated to the splunkforwarder service. I went to Start, Administrative Tools, Services, and selected the SplunkForwarder service and double-clicked to open it. Then, on the logon tab, I updated the password to the new one that I had changed it to. After that, I was able to start the splunkforwarder by typing ".\splunk start" from the c:\Program Files\SplunkUniversalForwarder\bin directory.
The symptom I was getting on the Splunk side was that it would attempt to start the forwarder, and everything would pass correctly and it would look like it was going to start, but then it would just say "SplunkForwarder: Stopped". It wasn't until I looked into the Windows logs to see the error 1069: The service did not start due to a logon failure.
... View more