New Universal Forwarder not sending data to Splunk.

Available Languages

Updated:October 1, 2026

Document ID:SPLK052648

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise 10.0.0

Description

Universal Forwarder unable to forward log file data to Splunk.

Investigation

Noticed Splunk is able to start but not connecting and working as expected.

When looking for errors there were many errors referring to lost packages in Splunk UF and outputs configurations:

"8-29-2025 10:29:26.684 -0400 ERROR TcpOutputProc [4708 parsing] - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf"InstalledFilesHashChecker [4416 LazyGlobalManifestCheck] - An installed file="C:\Program Files\SplunkUniversalForwarder\bin\100_xxxxx_splunkcloud.spl" did not pass hash-checking due to reason="file present, but is not part of Splunk installation package"InstalledFilesHashChecker [4416 LazyGlobalManifestCheck] - An installed file="C:\Program Files\SplunkUniversalForwarder\bin\outputs-debug.log" did not pass hash-checking due to reason="file present, but is not part of Splunk installation package"

Resolution

In order to solve the the first error is need to reinstall the credential package following all the correct steps.

Install credential package

To solved the second error about the missing files is needed to reinstall the Splunk entire package, as there is a missing package on Splunk during the installation process for an unknown reason, the recommendation will be to get a new installation package from the official Splunk site.

Install UF on Windows server

Install UF on Linux server