Splunk Enterprise

Why is Splunkd service timing out when trying to use a MSA?


Splunk Version: Splunk Enterprise 7.0.3
Local Host OS: Windows 7
I have been unable to start Splunkd Service successfully using an MSA. The following is a summary of the steps taken:

  • Installed Splunk via CLI to be run as Local System user
  • Started Splunk successfully
  • Switch Log On option of Splunkd Service to my personal domain user account
  • Started Splunk successfully
  • Switch Log On option of Splunkd Service to MSA
  • Splunk fails to start.
  • CLI reports “Timed out waiting for splunkd to start.” Windows’ Services GUI reports "Error 1067: The process terminated unexpectedly."
  • Investigation of $SPLUNK_HOME\var\log\splunk\splunkd-utility.log revealed MSA permission issues for accessing the following:
  • File - splunk.secret Dir - $Splunk_Home\etc\license
  • I manually granted MSA permissions necessary to access these locations. No more errors show up in the splunkd-utility.log
  • Splunk fails to start.
  • No splunkd.log is created when the Service does not successfully start
    The only semi-suspicious log found is in splunkd-utility.log which states:

  • ServerConfig – Found no hostname options in server.conf. Will attempt to use default for now.
    ServerConfig – Host name option is “”.

Could this be an issue? Is there some other location (.log) I should inspect to determine where my current issue resides?

Tags (2)
0 Karma

New Member


did you granted the MSA permission recursively on the splunk installation directory ?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!