topic Re: Splunk port issue in Security

Splunk port issue

uagraw01 — Fri, 26 Nov 2021 08:42:29 GMT

Hello SPlunkers!!

I have upgraded my HF from 8.0.0 to 8.1.2, while upgradation everything is working fine. But the issue is the i am not able to open the server on UI on port 8000.

tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 2170/splunkd

port 8000 is also working fine.

But the issue is that whenever i have tried to pen the server from Ui it throughing bad request error.

What the things i have done yet.

1. copy the web.conf file from the system default to system local

2. change the splunk user cmod splunk:splunk /opt/splunk

But still the issue is persist please help me to get it resolve.

Re: Splunk port issue

isoutamo — Fri, 26 Nov 2021 09:03:49 GMT

What you can found from log files e.g. splunkd.log at /opt/splunk/var/log/splunk?

Re: Splunk port issue

uagraw01 — Fri, 26 Nov 2021 09:40:16 GMT

There is no error as such in splunkd.log. But my UI is not working

Re: Splunk port issue

KulvinderSingh — Fri, 26 Nov 2021 11:23:27 GMT

I think I know what went wrong

chmod splunk:splunk -R /opt/splunk

you forgot to add change permissions on directory level you need to add -R to the command to add permissions recursively.

hope that helps.

Re: Splunk port issue

Siddharth — Wed, 01 Dec 2021 21:35:23 GMT

Kill the splunk service and restart the server It have happened with me and worked after server restart . Please do check all the crontab running on the server before reboot it will take around 4-5 mins

To reboot switch to sudo account then use the command "reboot"