Docker: Universal Forwarder Upgrade Error: calling execve(): No such file or directory Error launching
Available Languages
Applicability
Docker Splunk Enterprise Universal Forwarder 9.0.xDescription
The following is seen when attempting an Universal Forwarder upgrade on Docker and Linux:Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk /opt/splunkforwarder" Error calling execve(): No such file or directory Error launching command: No such file or directory This appears to be an upgrade of Splunk. --------------------------------------------------------------------------------) Splunk has detected an older version of Splunk installed on this machine. To finish upgrading to the new version, Splunk's installer will automaticallyupdate and alter your current configuration files. Deprecated configurationfiles will be renamed with a .deprecated extension. You can choose to preview the changes that will be made to your configurationfiles before proceeding with the migration and upgrade: If you want to migrate and upgrade without previewing the changes that will bemade to your existing configuration files, choose 'y'. If you want to see what changes will be made before you proceed with theupgrade, choose 'n'. Perform migration and upgrade without previewing configuration changes? [y/n] y -- Migration information is being logged to '/opt/splunkforwarder/var/log/splunk/migration.log.2023-02-20.13-34-33' -- Migrating to: VERSION=9.0.2 BUILD=17e00c557dc1 PRODUCT=splunk PLATFORM=Linux-x86_64 Error calling execve(): No such file or directory Error launching command: Invalid argument
Investigation
This is a reported issue relating to the Universal Forwarder image for Docker. This impacts versions 9.0.x and does not occur on the versions before 9.0. This error is due to the splunkd.xml file being provided with the Splunk image when systemd is not available in the container.Resolution
Workaround:* Remove: /opt/splunkforwarder/etc/myinstall/splunkd.xml file then start Splunk
Or this can be confgured:
* Add the following to the compose file:
splunk: tty: trueNote: The /opt/splunkforwarder/etc/myinstall/splunkd.xml is incorrectly created with the 9.0.x Docker Universal Forwarder images.
Related Links
https://docs.splunk.com/Documentation/Forwarder/9.0.4/Forwarder/Upgradetheuniversalforwardhttps://community.splunk.com/t5/Installation/Upgrading-Universal-Forwarder-8-x-x-to-9-x-x-does-not-work/m-p/619919
https://stackoverflow.com/questions/66638731/why-do-i-need-tty-true-in-docker-compose-yml-and-other-images-do-not
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
30-Sep-2026
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)
This Document Applies to These Products
Related Articles
- Error "Error calling execve(): No such file or directory" when starting Splunk forwarder
- In Universal forwarder 9.3.x: Errors such as "No such file or directory" and "segmentation fault" occur when splunk command is executed
- S3ClientProps IamServiceAccountAwsCredentials error failed to open identity token file AWS_WEB_IDENTITY_TOKEN_FILE error=No such file or directory