Similar problem here - 2008r2 x64, Splunk 4.3, applied the January Microsoft patches and now get this when the SplunkWeb service tries to start:
The instance's SvcRun() method failed
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 785, in SvcRun
self.SvcDoRun()
File "C:\Program Files\Splunk\bin\SplunkWebService.py", line 37, in SvcDoRun
subprocess.call(gMakeCertsCmd)
File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 493, in call
return Popen(*popenargs, **kwargs).wait()
File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 679, in __init__
errread, errwrite)
File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 893, in _execute_child
startupinfo)
<type 'exceptions.WindowsError'>: [Error 193] File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 785, in SvcRun
self.SvcDoRun()
File "C:\Program Files\Splunk\bin\SplunkWebService.py", line 37, in SvcDoRun
subprocess.call(gMakeCertsCmd)
File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 493, in call
return Popen(*popenargs, **kwargs).wait()
File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 679, in __init__
errread, errwrite)
File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 893, in _execute_child
startupinfo) is not a valid Win32 application
Tried removing the patches, but no good. I fixed it by:
Installing all Windows patches
Shutting down Splunk services
Backing up \var and \etc directories.
Uninstalling Splunk
Deleting any leftover directories
Reinstalling Splunk
Shut down Splunk services
Renaming \var and \etc directories
Copying the backed-up \var and \etc directories back into the Splunk directory
Restarting Splunk services.
All good now!
... View more