Getting Data In

After upgrading to 4.2 Failed to start splunkweb service

elusive
Splunk Employee
Splunk Employee

Upgrade from 4.1.x to 4.2, when I try to start Splunk Splunkd starts but splunkweb fails with the following message:

D:\Program Files\splunk\bin>splunk start

Splunk> All batbelt. No tights.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking configuration...  Done.
        Checking index directory...
        Validated databases: _audit _blocksignature _internal _thefishbucket his
tory main summary summary_forwarders summary_hosts summary_indexers summary_pool
s summary_sources summary_sourcetypes
        Done
Success
   Checking conf files for typos...
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Splunkd: Starting (pid 3748)
Done.
Starting splunkweb...
Splunkweb: Stopped
Failed to start splunkweb service.

D:\Program Files\splunk\bin>

gkanapathy
Splunk Employee
Splunk Employee

You should note that this is on Windows.

0 Karma

elusive
Splunk Employee
Splunk Employee

Splunk Web services needs to be rebuilt. In order to rebuild your services, run the following:

  1. Make sure Splunkd and Splunk Web are both stopped:
    D:\Program Files\splunk\bin>splunk stop
    Splunkweb: Stopped
    Splunkd: Stopped

  2. Remove the Splunkd and SplunkWeb services:
    D:\Program Files\splunk\bin>splunk disable boot-start
    Removing service Splunkd
    Service removed
    Disabled.
    Removing service Splunkweb
    Service removed
    Disabled.

  3. Now rebuild splunkd and Splunkweb services:
    D:\Program Files\splunk\bin>splunk enable boot-start
    Installing service Splunkd
    Service installed
    Registering the Python Service Manager...
    Installing service Splunkweb
    Service installed
    Windows services installed.
    Windows services are configured to run at boot.

NOTE:

This will create Splunkd and Splunkweb services with the following properties:

  • Startup type = Automatic
  • Log On As = Local System

Depending on your configuration you will need to make changes to it.
You can make changes in the services console or via the "sc command line program" .

The following instruction is run in the services console:

  • Open windows services console (Start >Control Panel > Administrative Tools > Services)
  • Double click on splunkd services
  • Change the Startup type in General Tab. Change the Log On As account in Log On tab.

The following is to make changes using sc command
Note: you must have a space following the "=" for the value to be specified properly in the sc config command

1. To make changes for Splunkd startup enter:

D:\Program Files\splunk\bin>sc config Splunkd start= demand
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

2. To make changes for SplunkWeb startup enter:

D:\Program Files\splunk\bin>sc config Splunkweb start= demand
[SC] ChangeServiceConfig SUCCESS

To make changes for Splunkd Log On As:

D:\Program Files\splunk\bin>sc config Splunkd obj= {domain}{adminAccount} password= {password}
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

NOTE: please replace {domain}, {adminAccount} and {password} with your Splunk domain administrator account.

3. To make changes for Splunkweb Log On As enter:

D:\Program Files\splunk\bin>sc config Splunkweb obj= {domain}{adminAccount} password= {password}
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

NOTE: please replace {domain}, {adminAccount} and {password} with your Splunk domain administrator account.

Additional reference link: http://www.splunk.com/base/Documentation/4.2/Admin/ConfigureSplunktostartatboottime

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...