can't start splunkweb

[Jcath]

My splunkweb can't start and on web_service.log show:
2025-10-24 15:53:53,423 ERROR [68fb3e92b912c89de7070] root:764 - Unable to start splunkweb
2025-10-24 15:53:53,423 ERROR [68fb3e92b912c89de7070] root:765 - ("no 'settings' stanza exists in web.conf. Your configuration may be corrupt or may require a restart.",)
i had not touch any conf in web.conf and checked all web.conf files. pls help

[livehybrid]

Hi @Jcath 

Can you confirm that the ownership of all the files in $SPLUNK_HOME/etc/system/default are set to the correct user that splunk is running as (usually 'splunk') .

Unless you have removed any default files Splunk should be able to read the default values from the web.conf there so it seems like it could be a permissions issue.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Jcath]

no, i didnt modify /local/web.conf. I had checked /default/web.conf and it's still okay. After that, I tried to fix it by add settings stanza in /local/web.conf exactly like you say, but still the same

[PrewinThomas]

@Jcath 

Can you run

 $SPLUNK_HOME/bin/splunk btool web list --debug

This lists the effective web.conf settings and where they are loaded from, share this

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[PrewinThomas]

@Jcath 

Did you remove or edit your web.conf?
Splunk Web is refusing to start because it can’t find the [settings] stanza in web.conf, most probably corrupted or deleted web.conf

If you deleted or modified your web.conf, add a file $SPLUNK_HOME/etc/system/local/web.conf with minimal and restart splunk

[settings]
httpport = 8000

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!