Why is the Splunk Web service not running after an upgrade from 6.1 to 6.2?

[matt]

I upgraded Splunk Enterprise on Win 2012 from 6.1.4 to 6.2 today, and I am noticing strange behavior from the Splunk Web service:

• The Splunk Web service seems to no longer automatically start after the upgrade.

• If I go to the Services Manager and attempt to start it manually I get the following:

  Error 1053: The service did not respond to the start or control request in a timely fashion

  • What's odd is the login page is still available via the web interface and logging is still occurring like it should.

Is my upgrade broken?

[hexx · Accepted solution]

As stated in the 6.2 Installation Manual, the Splunk Web service - while still installed and enabled - is expected to start and then immediately stop.

This is because the user interface (a.k.a "Splunk Web") has been incorporated into the main splunkd service. This cuts out CherryPy (which the "old" Splunk Web was based on) as the middlemen for many requests, and results in a considerable performance improvement for several UI pages.

Note that if you list processes, you will still find CherryPy running, but as a child process of the main splunkd service that only services certain requests that depend on it as an appserver (mostly, pages that still depend on server-side Python code).

In other words: The behavior you are seeing is expected and there is no action for you to take.

A product defect has been filed to review the error message produced by the Windows service manager and see if it can be suppressed, as it is clearly undesirable and confusing.

[gkanapathy]

And the reason the service still exists and that you don't want to delete it is that it is still possible to reconfigure the system to use the old SplunkWeb/CherryPy UI server. If you need to do so, then you will need the Service to run and control the process.

[jrodman]

I would say rather that it's possible to configure the system to use the CherryPy/SplunkWeb server in the same WAY as 6.1. It's the same code regardless of the configuration.