I recently upgraded my splunk 6.0.5 on Windows 2008 successfully. However, now I cannot start splunkweb service. The splunkd service has started up fine. I do not see any error in splunkd.log or web_service.log.
I have tried "splunk start" command and splunkweb appeared to have started, but about 2 seconds later, stopped.
Symptom similar to the one described here:
http://answers.splunk.com/answers/95467/splunkweb-service-wouldnt-start.html
Hi,
I would start by checking the Windows Event Viewer, specifically the Applications log. I recently ran into similar scenario, and this was what I have found in the Windows application log:
Error log: The instance's SvcRun() method failed Traceback (most recent call last): File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 835, in SvcRun self.SvcDoRun() File "E:\Program Files\Splunk\bin\SplunkWebService.py", line 40, in SvcDoRun root.run(blocking=False) File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 601, in run i18n.init_i18n_cache(flush_files=True) File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\i18n.py", line 838, in init_i18n_cache os.unlink(os.path.join(CACHE_PATH, fn)) WindowsError: (32, 'The process cannot access the file because it is being used by another process', 'E:\\Program Files\\Splunk\\var\\run\\splunk\\appserver\\i18n\\version')
So I went to check the version file mentioned in the error and noticed it has empty content. It almost seemed like the file has gotten corrupted somehow. I deleted the file and then splunkweb was able to startup fine again.
See This:
"The Splunk Web service installs but does not run
Beginning with Splunk Enterprise v6.2, the splunkd service handles all Splunk Web operations. However, on Windows instances, the installer still installs the splunkweb service, although the service quits immediately on launch when operating in normal mode. You can configure the service to run in legacy mode by changing a configuration parameter in web.conf. See "Start Splunk Enterprise on Windows in legacy mode" in the Admin manual.
Important: Do not run Splunk Web in legacy mode permanently. Use legacy mode to temporarily work around issues introduced by the new integration of the user interface with the main splunkd service. Once you correct the issues, return Splunk Web to normal mode as soon as possible." Link : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/Aboutupgradingto6.2READTHISFIRST
To supplement @Raghav2384's answer, this exact topic has been covered in a previous Answers post http://answers.splunk.com/answers/177187/why-is-the-splunk-web-service-not-running-after-an.html
http://answers.splunk.com/answers/95467/splunkweb-service-wouldnt-start.html any chance this is the case?