Installation

Receiving the following error: "failed to start splunk.service: unit splunk.service not found"

olaitan2010
Engager

After installing Splunk on my Ubuntu, I can't get it to start.

I get this error "failed to start splunk.service: unit splunk.service not found."

Labels (1)

AzmathShaik
Path Finder

Couple of reasons that might cause this issue

  1. splunk boot start is not enabled as the splunk user
  2. daemon-reload might have failed

please try the below steps

  1. systemctl daemon-reload
  2. the run the boot start command ( if already enabled it should say file exists)
  3. run the old method for starting and stopping splunk ( start should fail asking the system password)
  4. run systemctl start Splunkd ( should start splunk)

nqjpm
Path Finder

Had the same issue and going back through these steps AzmathShaik gave resolved it for me.
A little more detail...

  1. systemctl daemon-reload
  2. the run the boot start command ( if already enabled it should say file exists). ---###File is located at /etc/systemd/system/Splunkd.service. Might want to check who owns it with ls -la
  3. run the old method for starting and stopping splunk ( start should fail asking the system password)
    ### run $SPLUNK_HOME/bin/splunk <start/stop>
  4. run systemctl start Splunkd ( should start splunk)

highsplunker
Contributor

Thanks! Worked for me too!

0 Karma

evania
Splunk Employee
Splunk Employee

Hi @olaitan2010
Did you have a chance to check out these answers? If any worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

mayurr98
Super Champion

Hello if you are sure that you've installed splunk in opt directory
then go to bin directory like this: cd /opt/splunk/bin/
now run this command from your bin directory: ./splunk start or ./splunk restart

lexesco99
Engager

Thanks, This fixed my issue. When I ran ./splunk start the upgrade started.

0 Karma

highsplunker
Contributor

hi,

i guess i have the same issue. but with your suggestion, splunk will not start with systemd, for example.

so, imho, there should other ways.

0 Karma

dataops
Engager

This worked.

root@aryan-VirtualBox:~# cd /opt/splunk/bin/
root@aryan-VirtualBox:/opt/splunk/bin# ls
bloom jars scripts
bottle.py jp.py scrubber.py
btool jsmin searchtest
btprobe locktest setSplunkEnv
bzip2 locktool shc_upgrade_template.py
cherryd mongod signtool
classify mongod-3.4 slim
ColdStorageArchiver.py mongod_cc splunk
coldToFrozenExample.py node splunkd
copyright.txt openssl splunkdj
dbmanipulator.py parsetest splunkmon
exporttool parse_xml_buckets.py splunk-optimize
fill_summary_index.py pcregextest splunk-optimize-lex
genAuditKeys.py pid_check.sh srm
genRootCA.sh python tarit.py
genSignedServerCert.py python2 tocsv.py
genSignedServerCert.sh python2.7 tsidxprobe
genWebCert.py recover-metadata tsidxprobe_plo
genWebCert.sh rest_handler.py tsidx_scan.py
importtool runScript.py untarit.py
installit.py safe_restart_cluster_master.py walklex
root@aryan-VirtualBox:/opt/splunk/bin# ./splunk start
The splunk daemon (splunkd) is already running.

If you get stuck, we're here to help.

Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://aryan-VirtualBox:8000

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

It looks like you are trying to start using systemd except you got the servicename wrong. By default it is

systemctl start Splunkd

(capital S)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...