Rolling restart index cluster failed

Available Languages

Updated:September 28, 2026
Document ID:SPLK044445

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

Rolling restart fails for some indexers in a way that they shut-down completely and never start.  
Failed to restart peer=23E21EE7-3BD5-4ACC-8334-7DDA16AE76D8 peer_name=<Hostname>. Moving to 
failed peer group and continuing. 
Failing peer=23E21EE7-3BD5-4ACC-8334-7DDA16AE76D8 peer_name=<Hostname> timed out while trying 
to restart.

Investigation

Finding that "startwebserver = 0" was configured. 

Resolution

Workaround:
Change startwebserver = 0 to startwebserver = 1  

For example: 
web.conf[settings]
startwebserver = 1
 

    Revision History

    Revision Publish Date Comments
    1.0
    28-Sep-2026
    Initial Release

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products