installed version was 4.3.4, started the 5.0 installer, selected option to let the installer upgrade my current installation. After installer completed the web interface was unavailable, i went and checked the services and "splunkweb" was not running, when I tried to start the service it errored out, here is the error from the application log in the event viewer -
Log Name: Application
Source: Splunkweb
Date: 10/30/2012 4:50:24 PM
Event ID: 3
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: ATL-LOGMGMT-01.dtiad.local
Description:
The instance's SvcRun() method failed
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 785, in SvcRun
self.SvcDoRun()
File "C:\Program Files\Splunk\bin\SplunkWebService.py", line 39, in SvcDoRun
from splunk.appserver.mrsparkle import root
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 556, in <module>
sys.exit(1)
<type 'exceptions.SystemExit'>: 1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Splunkweb" />
<EventID Qualifiers="49152">3</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-10-30T20:50:24.000000000Z" />
<EventRecordID>2646</EventRecordID>
<Channel>Application</Channel>
<Computer>ATL-LOGMGMT-01.dtiad.local</Computer>
<Security />
</System>
<EventData>
<Data> File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 785, in SvcRun
self.SvcDoRun()
File "C:\Program Files\Splunk\bin\SplunkWebService.py", line 39, in SvcDoRun
from splunk.appserver.mrsparkle import root
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 556, in <module>
sys.exit(1)</Data>
<Data><type 'exceptions.SystemExit'></Data>
<Data>1</Data>
</EventData>
</Event>
Hi,
Take a look at %SPLUNK_HOME%/var/log/splunk/web_service.log and see if there are any errors there.
Hi,
Take a look at %SPLUNK_HOME%/var/log/splunk/web_service.log and see if there are any errors there.
I had the exact same issue upgrading from 4.3.3 to 5.0. Coping TA_Windows_FTR AND TA_Windows_IFrame as Windows_FTR AND Windows_IFrame resolved the issue.
Okay, that's cool. But, if you would, please open a ticket with Splunk support anyway and reference all the information on this page, including what you had to do to get splunkweb to start correctly. Thanks!
I renamed the folder and had to rename another folder in the same path TA_Windows_FTR to Windows_FTR. The splunkweb service now starts correctly.
Okay, can you make a copy of that folder (and all its contents) and rename it to "Windows_IFrame" and let me know what happens?
Were you running the Windows app prior to your upgrade?
the log shows this error -
2012-10-30 16:50:24,191 ERROR [50903d8ff122e33c8] root:555 - [Error 3] The system cannot find the path specified: 'C:\\Program Files\\Splunk\\etc\\apps\\Splunk_TA_windows\\appserver\\modules\\Windows_IFrame/*.*'
The path is correct up to the last folder, the path shows Windows_IFrame, but the folder on the file system is called TA_Windows_IFrame