We had the same issue when migrating from 8.2.11 to 9.0.5. I found a file (with the unix "file" command) with "different" settings in the directory that was processed before this "unforeseen error" occurred, in our case the effected file was: /opt/splunk/etc/apps/ForensicInvestigator/default/data/ui/views/portsservices.xml: HTML document, Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators After converting this file (by "iconv -f UTF-16LE -t UTF-8") the command "/opt/splunk/bin/splunk start" executed without error. ... View more