topic Re: Splunk standalone server in Installation

Splunk standalone server: Why after the OS update the Splunk is unable to run the service?

iamtheclient20 — Tue, 08 Aug 2023 16:36:36 GMT

Splunk Version: 8
OS: Windows Server

Good afternoon.

Maybe someone here may give me an idea how to troubleshoot.
Customer update the OS of Windows server, then after the OS update the Splunk is unable to run the service.
WARNING: Seems web interface is not to be available.

No logs written in splunkd.log

The folder or directory of Splunk is under Splunk user.

Thank you.

Re: Splunk standalone server

isoutamo — Tue, 08 Aug 2023 07:06:40 GMT

Have you try to start it manually?

If splunk logs haven't anything, are you check also windows event viewer?

Which Windows version + exact splunk version 8.2.??

Physical or virtual hardware?

r. Ismo

Re: Splunk standalone server

gcusello — Tue, 08 Aug 2023 07:07:58 GMT

Hi @iamtheclient20,

at first, did you disabled the Windows local firewall or another protectio?

What's the version of the new windows?

Splunk 8.X is certified for Windows 10, Windows Server 2016 and 2019.

Ciao.

Giuseppe

Re: Splunk standalone server

iamtheclient20 — Tue, 08 Aug 2023 07:14:38 GMT

Splunk Version 8.2.6, residing in physical server.
I also tried to start the splunk using windows services but not luck.
I did not check this windows event viewer.

I am thinking to update to latest version of Splunk.

Re: Splunk standalone server

iamtheclient20 — Tue, 08 Aug 2023 07:24:26 GMT

Windows Server 2012 R2 Standard. We already check the itself firewall seems ok .

Re: Splunk standalone server

gcusello — Tue, 08 Aug 2023 07:35:59 GMT

Hi @iamtheclient20,

this windows version isn't certified for Splunk 8, and this could be the issue, even if I don't think.

Are you able co connect to the server, using the browser, from itself?

If you can open a case to Splunk Support.

Ciao.

Giuseppe

Re: Splunk standalone server

isoutamo — Tue, 08 Aug 2023 07:55:47 GMT

Based on this https://docs.splunk.com/Documentation/Splunk/7.3.9/Installation/Systemrequirements Splunk 7.3 is latest officially supported version for Window 2012 or 2012 R2.

Platform support changes in version 8.0 also confirm that.

Anyhow Windows 2012R2 will be out of support quite soon (https://learn.microsoft.com/en-us/lifecycle/announcements/windows-server-2012-r2-end-of-support) so you should upgrade it anyhow to some recent version to secure your environment.

Re: Splunk standalone server

iamtheclient20 — Tue, 08 Aug 2023 08:46:12 GMT

I am not able to connect using browser ifself. Yes, upon checking OS version is not supported. Thanks

Re: Splunk standalone server

iamtheclient20 — Tue, 08 Aug 2023 08:47:14 GMT

Thank you for these reference, we will consider that.