Are you running a version of Splunk Enterprise prior to 6.6.3 and the restarts are taking forever? I feel your pain. If I wasn't at work, I'd probably take a nap while waiting for the services to come back up.

The good news is that fixing the very long restart times is really simple. If allowing production servers to touch the internet is something you want or can do, then adding a quick proxy export statement to the profile of the user running Splunk. This will allow Splunk to talk to the update URLs.

Proxy or not, if the thought of allowing Splunk to reach the internet gives you the willies, here's what you should do. Add QUICKDRAW_URL = 0 to the bottom of splunk-launch.conf. You'll find that config file in /opt/splunk/etc or $SPLUNK_HOME/etc if Splunk was installed using the default location.

Restart Splunk but don't blink. You might miss it.

Before:

After: