Splunkweb failed to start after upgrading to 6.2

[tsunamii]

I recently upgraded my splunk 6.0.5 on Windows 2008 successfully. However, now I cannot start splunkweb service. The splunkd service has started up fine. I do not see any error in splunkd.log or web_service.log.

I have tried "splunk start" command and splunkweb appeared to have started, but about 2 seconds later, stopped.

Symptom similar to the one described here:

http://answers.splunk.com/answers/95467/splunkweb-service-wouldnt-start.html

[splunkIT]

Hi,
I would start by checking the Windows Event Viewer, specifically the Applications log. I recently ran into similar scenario, and this was what I have found in the Windows application log:

Error log:

The instance's SvcRun() method failed 
Traceback (most recent call last):
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 835, in SvcRun
self.SvcDoRun()
File "E:\Program Files\Splunk\bin\SplunkWebService.py", line 40, in SvcDoRun
root.run(blocking=False)
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 601, in run
i18n.init_i18n_cache(flush_files=True)
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\i18n.py", line 838, in init_i18n_cache
os.unlink(os.path.join(CACHE_PATH, fn))
WindowsError: (32, 'The process cannot access the file because it is being used by another process', 'E:\\Program Files\\Splunk\\var\\run\\splunk\\appserver\\i18n\\version')

So I went to check the version file mentioned in the error and noticed it has empty content. It almost seemed like the file has gotten corrupted somehow. I deleted the file and then splunkweb was able to startup fine again.

[Raghav2384]

See This:
"The Splunk Web service installs but does not run
Beginning with Splunk Enterprise v6.2, the splunkd service handles all Splunk Web operations. However, on Windows instances, the installer still installs the splunkweb service, although the service quits immediately on launch when operating in normal mode. You can configure the service to run in legacy mode by changing a configuration parameter in web.conf. See "Start Splunk Enterprise on Windows in legacy mode" in the Admin manual.

Important: Do not run Splunk Web in legacy mode permanently. Use legacy mode to temporarily work around issues introduced by the new integration of the user interface with the main splunkd service. Once you correct the issues, return Splunk Web to normal mode as soon as possible." Link : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/Aboutupgradingto6.2READTHISFIRST

[ppablo]

To supplement @Raghav2384's answer, this exact topic has been covered in a previous Answers post http://answers.splunk.com/answers/177187/why-is-the-splunk-web-service-not-running-after-an.html

[aljohnson_splun]

http://answers.splunk.com/answers/95467/splunkweb-service-wouldnt-start.html any chance this is the case?