Getting Data In

After upgrading to 4.2 Failed to start splunkweb service

elusive
Splunk Employee
Splunk Employee

Upgrade from 4.1.x to 4.2, when I try to start Splunk Splunkd starts but splunkweb fails with the following message:

D:\Program Files\splunk\bin>splunk start

Splunk> All batbelt. No tights.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking configuration...  Done.
        Checking index directory...
        Validated databases: _audit _blocksignature _internal _thefishbucket his
tory main summary summary_forwarders summary_hosts summary_indexers summary_pool
s summary_sources summary_sourcetypes
        Done
Success
   Checking conf files for typos...
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Splunkd: Starting (pid 3748)
Done.
Starting splunkweb...
Splunkweb: Stopped
Failed to start splunkweb service.

D:\Program Files\splunk\bin>

gkanapathy
Splunk Employee
Splunk Employee

You should note that this is on Windows.

0 Karma

elusive
Splunk Employee
Splunk Employee

Splunk Web services needs to be rebuilt. In order to rebuild your services, run the following:

  1. Make sure Splunkd and Splunk Web are both stopped:
    D:\Program Files\splunk\bin>splunk stop
    Splunkweb: Stopped
    Splunkd: Stopped

  2. Remove the Splunkd and SplunkWeb services:
    D:\Program Files\splunk\bin>splunk disable boot-start
    Removing service Splunkd
    Service removed
    Disabled.
    Removing service Splunkweb
    Service removed
    Disabled.

  3. Now rebuild splunkd and Splunkweb services:
    D:\Program Files\splunk\bin>splunk enable boot-start
    Installing service Splunkd
    Service installed
    Registering the Python Service Manager...
    Installing service Splunkweb
    Service installed
    Windows services installed.
    Windows services are configured to run at boot.

NOTE:

This will create Splunkd and Splunkweb services with the following properties:

  • Startup type = Automatic
  • Log On As = Local System

Depending on your configuration you will need to make changes to it.
You can make changes in the services console or via the "sc command line program" .

The following instruction is run in the services console:

  • Open windows services console (Start >Control Panel > Administrative Tools > Services)
  • Double click on splunkd services
  • Change the Startup type in General Tab. Change the Log On As account in Log On tab.

The following is to make changes using sc command
Note: you must have a space following the "=" for the value to be specified properly in the sc config command

1. To make changes for Splunkd startup enter:

D:\Program Files\splunk\bin>sc config Splunkd start= demand
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

2. To make changes for SplunkWeb startup enter:

D:\Program Files\splunk\bin>sc config Splunkweb start= demand
[SC] ChangeServiceConfig SUCCESS

To make changes for Splunkd Log On As:

D:\Program Files\splunk\bin>sc config Splunkd obj= {domain}{adminAccount} password= {password}
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

NOTE: please replace {domain}, {adminAccount} and {password} with your Splunk domain administrator account.

3. To make changes for Splunkweb Log On As enter:

D:\Program Files\splunk\bin>sc config Splunkweb obj= {domain}{adminAccount} password= {password}
[SC] ChangeServiceConfig SUCCESS

D:\Program Files\splunk\bin>

NOTE: please replace {domain}, {adminAccount} and {password} with your Splunk domain administrator account.

Additional reference link: http://www.splunk.com/base/Documentation/4.2/Admin/ConfigureSplunktostartatboottime

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...