If the Splunkd Service is running but unable to start web service in Windows or Linux
Check if the web-port configured is open and listening on the instance(sometimes another process is bound to the port)
Check if any firewall rule has been enabled to block
Check if Certificates and SSL is working as expected then try to restart with disabled WebSSL under web.conf to isolate the issue
[settings]
enableSplunkWebSSL = false
Check if any AV(Antivirus) product is running on the server.
https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts
When you run Splunk (Enterprise or forwarder) on a host that has an anti-virus product (such as McAfee VirusScan on Windows or Trend Micro ServerProtect on Linux) installed, Splunk strongly recommends that you exclude all Splunk processes as well as the Splunk installation directory from any kind of on-access scanning.
Splunkd is running but once you try to restart the web service via CLI, you might come across below response:
C:\Program Files\Splunk\bin>splunk restart splunkweb
502 Couldn't complete HTTP request: Winsock error #10061
Or
A server is busy message on HttpListener channel in splunkd log
Hope it helps.
... View more