Receiving the following error: "failed to start splunk.service: unit splunk.service not found"

New Member

After installing Splunk on my Ubuntu, I can't get it to start.

I get this error "failed to start splunk.service: unit splunk.service not found."

Labels (1)
0 Karma

Path Finder

Couple of reasons that might cause this issue

  1. splunk boot start is not enabled as the splunk user
  2. daemon-reload might have failed

please try the below steps

  1. systemctl daemon-reload
  2. the run the boot start command ( if already enabled it should say file exists)
  3. run the old method for starting and stopping splunk ( start should fail asking the system password)
  4. run systemctl start Splunkd ( should start splunk)
0 Karma

Community Manager
Community Manager

Hi @olaitan2010
Did you have a chance to check out these answers? If any worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

Super Champion

Hello if you are sure that you've installed splunk in opt directory
then go to bin directory like this: cd /opt/splunk/bin/
now run this command from your bin directory: ./splunk start or ./splunk restart


This worked.

root@aryan-VirtualBox:~# cd /opt/splunk/bin/
root@aryan-VirtualBox:/opt/splunk/bin# ls
bloom jars scripts
btool jsmin searchtest
btprobe locktest setSplunkEnv
bzip2 locktool
cherryd mongod signtool
classify mongod-3.4 slim mongod_cc splunk node splunkd
copyright.txt openssl splunkdj parsetest splunkmon
exporttool splunk-optimize pcregextest splunk-optimize-lex srm python python2 python2.7 tsidxprobe recover-metadata tsidxprobe_plo
importtool walklex
root@aryan-VirtualBox:/opt/splunk/bin# ./splunk start
The splunk daemon (splunkd) is already running.

If you get stuck, we're here to help.

Look for answers here:

The Splunk web interface is at http://aryan-VirtualBox:8000

0 Karma


It looks like you are trying to start using systemd except you got the servicename wrong. By default it is

systemctl start Splunkd

(capital S)

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!