I've got several windows servers which has got Splunk 4.1.3 installed and even though I disable webserver, configure Splunk as a LightForwarder, SplunkWeb keeps starting after the server has booted. If I restart splunk manually it doesn't start again.
After a (re)boot:
If I then manually restart Splunk on the same server:
New check, and as you can see, SplunkWeb isn't running anymore
I didn't use to manually disable webserver first since it's supposed to be disabled by Splunk when I enable the LightForwarder.. So why is webserver started?
This issue is fixed in the very latest release, 4.1.4. Check out the release notes: http://www.splunk.com/base/Documentation/latest/ReleaseNotes/4.1.4#Unsorted_issues
The issue you are encountering is
New installations of 4.1.4 should not have this problem any longer.
On your 4.1.3 servers you can disable the Splunkweb service with the following command run as a member of the Local Administrators group:
You can also do this remotely using
I think you'll have to manually stop the splunkweb service (from Start->Run->services.msc) and set its startup setting to either "manual" or "disabled".
Also, double check that splunkd get started with the proper permissions on the folder *$SPLUNK_HOME/var/*: if you start splunk from the CLI the first time and then reboot the system, the "System Local" user might not have the correct privileges to correctly startup splunkd.
This documentation page might help you out: Installation on Windows
answered 20 Jul '10, 15:25