Splunk service not starting after the upgrading Splunk

Available Languages

Updated:September 29, 2026
Document ID:SPLK046159

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

Splunk service not restarting after the upgrade of Splunk and shows an error below:
  
No permission to use address/port combination. Splunk needs to use this port.

Investigation

-Splunk should be installed by splunk user, but this instance was installed as root. Splunk was started by splunk user and all the folders/files are assigned to this user.
-User wants to keep current installation (user "root" user instead of "splunk").
 


Resolution

1. Change owner of /opt/splunk directory from "splunk" to "root".
2. Change SPLUNK_OS_USER from "splunk" to "root" in /opt/splunk/etc/splunk-launch.conf
3. Disable boot start.

/opt/splunk/bin/splunk disable boot-start

4. Enable boot start.

/opt/splunk/bin/splunk enable boot-start


This issue can be fixed with steps above but recommendation is installing Splunk as splunk user after cleaning up.
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products