Getting Data In

After upgrading to 4.2 Failed to start splunkweb service

elusive
Splunk Employee
Splunk Employee

Upgrade from 4.1.x to 4.2, when I try to start Splunk Splunkd starts but splunkweb fails with the following message:

D:\Program Files\splunk\bin>splunk start

Splunk> All batbelt. No tights.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking configuration...  Done.
        Checking index directory...
        Validated databases: _audit _blocksignature _internal _thefishbucket his
tory main summary summary_forwarders summary_hosts summary_indexers summary_pool
s summary_sources summary_sourcetypes
        Done
Success
   Checking conf files for typos...
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Splunkd: Starting (pid 3748)
Done.
Starting splunkweb...
Splunkweb: Stopped
Failed to start splunkweb service.

D:\Program Files\splunk\bin>

gkanapathy
Splunk Employee
Splunk Employee

You should note that this is on Windows.

0 Karma

elusive
Splunk Employee
Splunk Employee

Splunk Web services needs to be rebuilt. In order to rebuild your services, run the following:

  1. Make sure Splunkd and Splunk Web are both stopped:
    D:\Program Files\splunk\bin>splunk stop
    Splunkweb: Stopped
    Splunkd: Stopped

  2. Remove the Splunkd and SplunkWeb services:
    D:\Program Files\splunk\bin>splunk disable boot-start
    Removing service Splunkd
    Service removed
    Disabled.
    Removing service Splunkweb
    Service removed
    Disabled.

  3. Now rebuild splunkd and Splunkweb services:
    D:\Program Files\splunk\bin>splunk enable boot-start
    Installing service Splunkd
    Service installed
    Registering the Python Service Manager...
    Installing service Splunkweb
    Service installed
    Windows services installed.
    Windows services are configured to run at boot.

NOTE:

This will create Splunkd and Splunkweb services with the following properties:

  • Startup type = Automatic
  • Log On As = Local System

Depending on your configuration you will need to make changes to it.
You can make changes in the services console or via the "sc command line program" .

The following instruction is run in the services console:

  • Open windows services console (Start >Control Panel > Administrative Tools > Services)
  • Double click on splunkd services
  • Change the Startup type in General Tab. Change the Log On As account in Log On tab.

The following is to make changes using sc command
Note: you must have a space following the "=" for the value to be specified properly in the sc config command

1. To make changes for Splunkd startup enter:

D:\Program Files\splunk\bin>sc config Splunkd start= demand
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

2. To make changes for SplunkWeb startup enter:

D:\Program Files\splunk\bin>sc config Splunkweb start= demand
[SC] ChangeServiceConfig SUCCESS

To make changes for Splunkd Log On As:

D:\Program Files\splunk\bin>sc config Splunkd obj= {domain}{adminAccount} password= {password}
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

NOTE: please replace {domain}, {adminAccount} and {password} with your Splunk domain administrator account.

3. To make changes for Splunkweb Log On As enter:

D:\Program Files\splunk\bin>sc config Splunkweb obj= {domain}{adminAccount} password= {password}
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

NOTE: please replace {domain}, {adminAccount} and {password} with your Splunk domain administrator account.

Additional reference link: http://www.splunk.com/base/Documentation/4.2/Admin/ConfigureSplunktostartatboottime

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...