Splunkweb failed to start after upgrading to 6.2

Path Finder

I recently upgraded my splunk 6.0.5 on Windows 2008 successfully. However, now I cannot start splunkweb service. The splunkd service has started up fine. I do not see any error in splunkd.log or web_service.log.

I have tried "splunk start" command and splunkweb appeared to have started, but about 2 seconds later, stopped.

Symptom similar to the one described here:

0 Karma

Splunk Employee
Splunk Employee

I would start by checking the Windows Event Viewer, specifically the Applications log. I recently ran into similar scenario, and this was what I have found in the Windows application log:

Error log:

The instance's SvcRun() method failed 
Traceback (most recent call last):
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\", line 835, in SvcRun
File "E:\Program Files\Splunk\bin\", line 40, in SvcDoRun
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\", line 601, in run
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\", line 838, in init_i18n_cache
os.unlink(os.path.join(CACHE_PATH, fn))
WindowsError: (32, 'The process cannot access the file because it is being used by another process', 'E:\\Program Files\\Splunk\\var\\run\\splunk\\appserver\\i18n\\version')

So I went to check the version file mentioned in the error and noticed it has empty content. It almost seemed like the file has gotten corrupted somehow. I deleted the file and then splunkweb was able to startup fine again.

0 Karma


See This:
"The Splunk Web service installs but does not run
Beginning with Splunk Enterprise v6.2, the splunkd service handles all Splunk Web operations. However, on Windows instances, the installer still installs the splunkweb service, although the service quits immediately on launch when operating in normal mode. You can configure the service to run in legacy mode by changing a configuration parameter in web.conf. See "Start Splunk Enterprise on Windows in legacy mode" in the Admin manual.

Important: Do not run Splunk Web in legacy mode permanently. Use legacy mode to temporarily work around issues introduced by the new integration of the user interface with the main splunkd service. Once you correct the issues, return Splunk Web to normal mode as soon as possible." Link :

Community Manager
Community Manager

To supplement @Raghav2384's answer, this exact topic has been covered in a previous Answers post

0 Karma

Splunk Employee
Splunk Employee
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.