Security

Splunkweb failed to start after upgrading to 6.2

tsunamii
Path Finder

I recently upgraded my splunk 6.0.5 on Windows 2008 successfully. However, now I cannot start splunkweb service. The splunkd service has started up fine. I do not see any error in splunkd.log or web_service.log.

I have tried "splunk start" command and splunkweb appeared to have started, but about 2 seconds later, stopped.

Symptom similar to the one described here:

http://answers.splunk.com/answers/95467/splunkweb-service-wouldnt-start.html

0 Karma

splunkIT
Splunk Employee
Splunk Employee

Hi,
I would start by checking the Windows Event Viewer, specifically the Applications log. I recently ran into similar scenario, and this was what I have found in the Windows application log:

Error log:

The instance's SvcRun() method failed 
Traceback (most recent call last):
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 835, in SvcRun
self.SvcDoRun()
File "E:\Program Files\Splunk\bin\SplunkWebService.py", line 40, in SvcDoRun
root.run(blocking=False)
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 601, in run
i18n.init_i18n_cache(flush_files=True)
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\i18n.py", line 838, in init_i18n_cache
os.unlink(os.path.join(CACHE_PATH, fn))
WindowsError: (32, 'The process cannot access the file because it is being used by another process', 'E:\\Program Files\\Splunk\\var\\run\\splunk\\appserver\\i18n\\version')

So I went to check the version file mentioned in the error and noticed it has empty content. It almost seemed like the file has gotten corrupted somehow. I deleted the file and then splunkweb was able to startup fine again.

0 Karma

Raghav2384
Motivator

See This:
"The Splunk Web service installs but does not run
Beginning with Splunk Enterprise v6.2, the splunkd service handles all Splunk Web operations. However, on Windows instances, the installer still installs the splunkweb service, although the service quits immediately on launch when operating in normal mode. You can configure the service to run in legacy mode by changing a configuration parameter in web.conf. See "Start Splunk Enterprise on Windows in legacy mode" in the Admin manual.

Important: Do not run Splunk Web in legacy mode permanently. Use legacy mode to temporarily work around issues introduced by the new integration of the user interface with the main splunkd service. Once you correct the issues, return Splunk Web to normal mode as soon as possible." Link : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/Aboutupgradingto6.2READTHISFIRST

ppablo
Retired

To supplement @Raghav2384's answer, this exact topic has been covered in a previous Answers post http://answers.splunk.com/answers/177187/why-is-the-splunk-web-service-not-running-after-an.html

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...