Splunk Enterprise

Why is Splunkd service timing out when trying to use a MSA?

madavis1986
Explorer

Splunk Version: Splunk Enterprise 7.0.3
Local Host OS: Windows 7
 
I have been unable to start Splunkd Service successfully using an MSA. The following is a summary of the steps taken:

  • Installed Splunk via CLI to be run as Local System user
  • Started Splunk successfully
  • Switch Log On option of Splunkd Service to my personal domain user account
  • Started Splunk successfully
  • Switch Log On option of Splunkd Service to MSA
  • Splunk fails to start.
  • CLI reports “Timed out waiting for splunkd to start.” Windows’ Services GUI reports "Error 1067: The process terminated unexpectedly."
  • Investigation of $SPLUNK_HOME\var\log\splunk\splunkd-utility.log revealed MSA permission issues for accessing the following:
  • File - splunk.secret Dir - $Splunk_Home\etc\license
  • I manually granted MSA permissions necessary to access these locations. No more errors show up in the splunkd-utility.log
  • Splunk fails to start.
  • No splunkd.log is created when the Service does not successfully start
     
    The only semi-suspicious log found is in splunkd-utility.log which states:

  • ServerConfig – Found no hostname options in server.conf. Will attempt to use default for now.
    ServerConfig – Host name option is “”.

Could this be an issue? Is there some other location (.log) I should inspect to determine where my current issue resides?

Tags (2)
0 Karma

michaelissartel
Explorer

Hi,

did you granted the MSA permission recursively on the splunk installation directory ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...