Splunk Enterprise

can't start splunkweb

Jcath
Loves-to-Learn

My splunkweb can't start and on web_service.log show:
2025-10-24 15:53:53,423 ERROR [68fb3e92b912c89de7070] root:764 - Unable to start splunkweb
2025-10-24 15:53:53,423 ERROR [68fb3e92b912c89de7070] root:765 - ("no 'settings' stanza exists in web.conf. Your configuration may be corrupt or may require a restart.",)
i had not touch any conf in web.conf and checked all web.conf files. pls help

Labels (1)
0 Karma

Jcath
Loves-to-Learn

no, i didnt modify /local/web.conf. I had checked /default/web.conf and it's still okay. After that, I tried to fix it by add settings stanza in /local/web.conf exactly like you say, but still the same

0 Karma

PrewinThomas
Motivator

@Jcath 

Can you run

 $SPLUNK_HOME/bin/splunk btool web list --debug


This lists the effective web.conf settings and where they are loaded from, share this


Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

0 Karma

PrewinThomas
Motivator

@Jcath 

Did you remove or edit your web.conf?
Splunk Web is refusing to start because it can’t find the [settings] stanza in web.conf, most probably corrupted or deleted web.conf

 

If you deleted or modified your web.conf, add a file $SPLUNK_HOME/etc/system/local/web.conf with minimal and restart splunk

[settings]
httpport = 8000


Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...