I recently upgraded my splunk 6.0.5 on Windows 2008 successfully. However, now I cannot start splunkweb service. The splunkd service has started up fine. I do not see any error in splunkd.log or web_service.log.
I have tried "splunk start" command and splunkweb appeared to have started, but about 2 seconds later, stopped.
I would start by checking the Windows Event Viewer, specifically the Applications log. I recently ran into similar scenario, and this was what I have found in the Windows application log:
The instance's SvcRun() method failed
Traceback (most recent call last):
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 835, in SvcRun
File "E:\Program Files\Splunk\bin\SplunkWebService.py", line 40, in SvcDoRun
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 601, in run
File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\i18n.py", line 838, in init_i18n_cache
WindowsError: (32, 'The process cannot access the file because it is being used by another process', 'E:\\Program Files\\Splunk\\var\\run\\splunk\\appserver\\i18n\\version')
So I went to check the version file mentioned in the error and noticed it has empty content. It almost seemed like the file has gotten corrupted somehow. I deleted the file and then splunkweb was able to startup fine again.
"The Splunk Web service installs but does not run
Beginning with Splunk Enterprise v6.2, the splunkd service handles all Splunk Web operations. However, on Windows instances, the installer still installs the splunkweb service, although the service quits immediately on launch when operating in normal mode. You can configure the service to run in legacy mode by changing a configuration parameter in web.conf. See "Start Splunk Enterprise on Windows in legacy mode" in the Admin manual.