Universal Forwarder not auto restarting (Windows)

Applicability

Universal Forwarder on Windows Splunk Enterprise on Windows

Description

When a server is rebooted the Splunk service does not auto restart even though it comes with the flags LAUNCHSPLUNK=1  and SERVICESTARTTYPE=auto when installing it, which should allow it to auto restart automatically.

Investigation

Those flags are used during the installation time and most of them cannot be changed after that, basically because they do not go into any configuration file, which makes it impossible to push those settings through the deployment server.
 

Resolution

The reason why Universal Forwarders don't auto-restart is possibly due to the "Automatic" service startup type, as it will start the Splunk Forwarder service as soon as possible.

The solution for this should be to change the Startup type from "Automatic" to "Automatic (Delayed Start)"  in Windows services, which would allow a few minutes for services to auto-start after the system boots up.

Automatic (Delayed Start) should only be set if you are experiencing this issue, the default and recommended startup type is "Automatic". Please note that if a Delayed Start is used then the ServiceMain thread for the service is started with THREAD_PRIORITY_LOWEST. More information can be found below on this subject: 

https://learn.microsoft.com/en-us/windows/win32/api/winsvc/ns-winsvc-service_delayed_auto_start_info?redirectedfrom=MSDN

This setting should be thoroughly tested before being released into a Production environment.

To configure the service:
1. Open Control Panel > Services (or services.msc from the command prompt).
2. Find the Splunk Forwarder Service in the list and double-click to open
3. In the Startup type field, select Automatic (Delayed Start) from the list and click OK to apply

Since this is from Windows, it cannot be pushed through the Deployment Server.

It is recommended to use a Windows application/program to change the startup type of multiple machines at the same time; otherwise, it can only be applied one at a time per host. 

ControlUp Management Console is an example of an app for this.

Documentation Reference:  https://docs.splunk.com/Documentation/Splunk/9.1.0/Troubleshooting/AdvancedWindowsTroubleshooting

Related Links

Reference:
Splunk Docs Command Line Flags
Community Where are the flags from the Universal forwarder located config
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release