Just wanted to toss in another possible resolution.  If your system was ungracefully shutdown, resource exhaustion, virtualization host failure, etc. it's possible the splunkd.pid file wasn't cleaned up.  From what I have found, when splunkd attempts to start, it looks at this file and attempts various operations on the existing PIDs that are listed within.  They are obviously not there and the service will fail to start.  This will be made apparent when attempting to start splunk via the binary:  SPLUNK_HOME/bin/splunk start This file is located in SPLUNK_HOME/var/run/splunk/ and can be safely removed to correct.  A new file will be created upon splunkd service starting successfully.    ... View more