Splunk Version: Splunk Enterprise 7.0.3
Local Host OS: Windows 7
I have been unable to start Splunkd Service successfully using an MSA. The following is a summary of the steps taken:
- Installed Splunk via CLI to be run as Local System user
- Started Splunk successfully
- Switch Log On option of Splunkd Service to my personal domain user account
- Started Splunk successfully
- Switch Log On option of Splunkd Service to MSA
- Splunk fails to start.
- CLI reports “Timed out waiting for splunkd to start.”
Windows’ Services GUI reports "Error 1067: The process terminated unexpectedly."
- Investigation of $SPLUNK_HOME\var\log\splunk\splunkd-utility.log revealed MSA permission issues for accessing the following:
- File - splunk.secret
Dir - $Splunk_Home\etc\license
- I manually granted MSA permissions necessary to access these locations. No more errors show up in the splunkd-utility.log
- Splunk fails to start.
No splunkd.log is created when the Service does not successfully start
The only semi-suspicious log found is in splunkd-utility.log which states:
ServerConfig – Found no hostname options in server.conf. Will attempt to use default for now.
ServerConfig – Host name option is “”.
Could this be an issue? Is there some other location (.log) I should inspect to determine where my current issue resides?
