My splunkweb can't start and on web_service.log show:
2025-10-24 15:53:53,423 ERROR [68fb3e92b912c89de7070] root:764 - Unable to start splunkweb
2025-10-24 15:53:53,423 ERROR [68fb3e92b912c89de7070] root:765 - ("no 'settings' stanza exists in web.conf. Your configuration may be corrupt or may require a restart.",)
i had not touch any conf in web.conf and checked all web.conf files. pls help
no, i didnt modify /local/web.conf. I had checked /default/web.conf and it's still okay. After that, I tried to fix it by add settings stanza in /local/web.conf exactly like you say, but still the same
Can you run
$SPLUNK_HOME/bin/splunk btool web list --debug
This lists the effective web.conf settings and where they are loaded from, share this
Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
Did you remove or edit your web.conf?
Splunk Web is refusing to start because it can’t find the [settings] stanza in web.conf, most probably corrupted or deleted web.conf
If you deleted or modified your web.conf, add a file $SPLUNK_HOME/etc/system/local/web.conf with minimal and restart splunk
[settings]
httpport = 8000
Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!