Why Splunkd does not automatically restart when Windows server is rebooted and how to fix?

[AlexMcDuffMille]

Hello,

When I go to services.msc I have splunkd set up to restart as a user with a u/n and p/w. However, it does not automatically start when the server restarts. This is happening on several servers, including a search head and forwarders.

Does anybody else have this issue or any ideas on how I can fix it?

Thanks,
Alex

[Richfez]

I'd first check the event viewer to see if it casts any light on the reason.

A few more questions/comments to help pinpoint where things are going wrong:

• Is it a local user or domain user?
• Does the service start fine when you manually try it after a reboot?
• Set it to autostart(delayed) instead of just autostart and see if it works then.
• Try is to set it temporarily to use the local SYSTEM login and see if that works.

Note that if you set it to autostart(delayed) it can take several minutes to actually start, so don't be in a hurry.

If I had to make a guess with just the existing information, I'd say it's a domain account and for some reason domain services aren't available soon enough after bootup for the Splunk service to log in properly. The fix in that case would be to set the delayed start or set an appropriate dependency on the right services.

[AlexMcDuffMille]

• It is a domain user.

  • The service starts fine with the domain user credentials manually anytime (not just after a reboot of the server).
  • We tried setting it to delayed with the SYSTEM login, and it worked! We then tried delayed with the domain credentials and it did not work (after waiting several hours).

Any other ideas?

Thanks,
Alex

[damode]

Hi @Alex,

I am facing the same issue. If you were able to resolve it, please share your solution.

Thanks,
Dev