Forwarder not sending data to indexers due to FATAL config lock

Available Languages

Updated:September 29, 2026
Document ID:SPLK047948

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

After starting Splunk on a Heavy Forwarder following maintenance activity, starting from the CLI showed "Conf is currently being modified by process <pid>", proceeds to kill that PID, then states the Web UI is not available.

Splunk Web Not Starting

Though Splunkd appeared to be running, it may not forward data.


Investigation

Review of Splunkd.log shows Splunkd has encountered a file lock: 

11-30-2024 13:18:46.050 -0500 WARN loader [0 MainThread] - Sleep 10 sec, waiting for config lock.
11-30-2024 13:18:56.072 -0500 WARN loader [0 MainThread] - Sleep 10 sec, waiting for config lock.
11-30-2024 13:19:06.093 -0500 WARN loader [0 MainThread] - Sleep 10 sec, waiting for config lock.
11-30-2024 13:19:16.116 -0500 WARN loader [0 MainThread] - Sleep 10 sec, waiting for config lock.
11-30-2024 13:19:26.138 -0500 WARN loader [0 MainThread] - Sleep 10 sec, waiting for config lock.
11-30-2024 13:19:36.138 -0500 FATAL loader [0 MainThread] - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting.


 











Resolution
This suggests a locked file. The locks can be cleared following these simple steps:


 


  1. Stop splunk

    ./splunk stop
    

  2. Remove locked files, 1 of 2 ways:

    1. run this command:

      ./splunk clean locks
      

    2. Or, manually remove files named (*.pid or *.lock) in $SPLUNK_HOME\var\run\splunk\
    

  3. Start splunk

    ./splunk start
    



Verify Splunk has started correctly and data is flowing.

Splunk Community article


    
    


















     

     
    
            
         	

                
Revision History

                

                    
 
                        
                            

                                Revision
                                Publish Date
                                Comments
                            

                            
                                                
                            
          
                                    

                                        
1.0

                                        

                                            
                                                29-Sep-2026
                                            
                                        

                                        
                                            
Initial Release

                                                                    
                                    

          
                            

                        
                    

                

            

        
    








	




    


    

        














 




























    

    

        

    

    
    
     
			
            

























    
    
    
    









            

                

















  
  

  
    
    
    
    
  






            

        
            
            




















  
Was this Document Helpful?

  
    
    
  
  
    
      
      FeedbackFeedback
    
  







            

                

















  
    
  



            


            

                
















    
Contact Cisco

    







            


            
            































    
   
    





            

                























      

    
    	
This Document Applies to These Products

    
    
     
  


    


            


        
            

                
            

        

    

    
        

            
            

















    

            
Related Articles