topic Re: Why am I getting SplunkWeb start "error: [Errno 99] Cannot assign requested address" after moving the Splunk folder to another server with a different IP? in Security

Why am I getting SplunkWeb start "error: [Errno 99] Cannot assign requested address" after moving the Splunk folder to another server with a different IP?

hartfoml — Mon, 28 Sep 2020 17:51:49 GMT

I moved the splunk folder from one server to another with a different IP
I reinstalled the correct version of splunk on the new server the restarted splunk and splunkd started but not the webserver

At .conf the answers team helped me with an edit to the "$Splunk_home/lib/python2.7/site-packages/splunk/rest/init.py " and I changed the "SPLUNKD_CONNECTION_TIMEOUT =" from 30 to 130 and did a "$Splunk_home/bin/splunk restart" and the web server restarted OK.

Now back home from .conf and I cant start the web service. This looks like a different error than the timeout error.

Here is the "web_server.log" entry

2014-10-13 09:47:48,228 INFO    [543be60f9026ca450] root:138 - ENGINE: Bus STARTING
2014-10-13 09:47:48,277 WARNING [543be60f9026ca450] apps:101 - Duplicate module dir name 'static' between apps 'sos' and 'system', will refer to module dir in 'system'
2014-10-13 09:47:48,341 INFO    [543be60f9026ca450] root:138 - ENGINE: Started monitor thread '_TimeoutMonitor'.
2014-10-13 09:47:48,370 ERROR   [543be60f9026ca450] root:138 - ENGINE: Error in HTTP server: shutting down
Traceback (most recent call last):
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/process/servers.py", line 73, in _start_http_thread
    self.httpserver.start()
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 1725, in start
    raise socket.error, msg
error: [Errno 99] Cannot assign requested address

2014-10-13 09:47:48,370 INFO    [543be60f9026ca450] root:138 - ENGINE: Bus STOPPING
2014-10-13 09:47:48,371 ERROR   [543be60f9026ca450] root:138 - ENGINE: Error in 'stop' listener <bound method Server.stop of <cherrypy._cpserver.Server object at 0x26ca350>>
Traceback (most recent call last):
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/process/wspbus.py", line 147, in publish
    output.append(listener(*args, **kwargs))
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/process/servers.py", line 107, in stop
    self.httpserver.stop()
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 1909, in stop
    self.requests.stop(self.shutdown_timeout)
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 1458, in stop
    self._monitor_thread.join()
AttributeError: 'NoneType' object has no attribute 'join'

2014-10-13 09:47:48,376 INFO    [543be60f9026ca450] root:138 - ENGINE: Stopped thread '_TimeoutMonitor'.

Re: Why am I getting SplunkWeb start "error: [Errno 99] Cannot assign requested address" after moving the Splunk folder to another server with a different IP?

jimodonald — Mon, 13 Oct 2014 15:23:23 GMT

just a hunch, but is there already something listening on the port you've specified in web.conf?

What port do you have specified in web.conf?

and what does 'netstat -an' show? Is something already listening on that port?

Re: Why am I getting SplunkWeb start "error: [Errno 99] Cannot assign requested address" after moving the Splunk folder to another server with a different IP?

hartfoml — Mon, 13 Oct 2014 15:48:34 GMT

Thanks @jimodonald for the hunch.

I did netstat -an | grep 8000 and this returned nothing. I am using port 8000 for splunk web and nothing else is using that port. I think the comment or error above is referring to an IP address "error: [Errno 99] Cannot assign requested address"

Re: Why am I getting SplunkWeb start "error: [Errno 99] Cannot assign requested address" after moving the Splunk folder to another server with a different IP?

jimodonald — Mon, 13 Oct 2014 16:27:50 GMT

Can you check the serverName value is set to the current hostname in /opt/splunk/etc/system/local/server.conf?

Same for web.conf ?

Re: Why am I getting SplunkWeb start "error: [Errno 99] Cannot assign requested address" after moving the Splunk folder to another server with a different IP?

hartfoml — Mon, 13 Oct 2014 17:05:12 GMT

Thanks @jimodonald Sorry I did not get to this sooner. I was on the #Splunk IRC channel and they said the same thing.
I change the server name in the server.conf and the IP in tow places in the web.conf and the web server started. I then had to edit the iptables to allow port 8000 and I was in. thanks for the help from @yorokobi and @duckfez for the help. It is working now.