Unable to start splunkweb

albyva — Tue, 27 May 2014 13:42:56 GMT

I'm having the following issue getting (splunkweb) to start running. In the web_service.log file it gives the following error below. This is from a fresh install of v6.1 on a FreeBSD box.

2014-05-27 09:36:58,327 INFO [538494f9e78045de150] init:161 - Using default logging config file: /opt/splunk/etc/log.cfg

2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk level=INFO

2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver level=INFO

2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.controllers level=INFO

2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.controllers.proxy level=INFO

2014-05-27 09:36:58,329 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.lib level=WARN

2014-05-27 09:36:58,554 ERROR [538494f9e78045de150] root:729 - Unable to start splunkweb

2014-05-27 09:36:58,554 ERROR [538494f9e78045de150] root:730 - [Errno 2] No such file or directory: '/opt/splunk/share/splunk/search_mrsparkle/modules'

Traceback (most recent call last):

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 110, in

from controllers.top import *

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 13, in

from admin import AdminController

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 17, in

from splunk.appserver.mrsparkle.controllers.appinstall import AppInstallController

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/appinstall.py", line 9, in

from splunk.appserver.mrsparkle.lib import cached, module

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 460, in

moduleMapper = ModuleMapper()

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 79, in init

self.installedModules = self.getInstalledModules()

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 24, in helper

return f(*a, **kw)

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 443, in getInstalledModules

mods = self.getModuleList(root)

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 33, in helper

return f(*a, **kw)

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 211, in getModuleList

for (app_name, module_name, module_path) in local_apps.getAllModules():

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 195, in getAllModules

self.refresh(False)

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 121, in refresh

'modules' : self._scanSystemModules()

File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 150, in _scanSystemModules

for module_dir in os.listdir(self.system_modules_path):

OSError: [Errno 2] No such file or directory: '/opt/splunk/share/splunk/search_mrsparkle/modules'

Re: Unable to start splunkweb

albyva — Mon, 28 Sep 2020 16:43:49 GMT

Guess what???? Did Splunk (The Corporation) name the directory as modules.new instead of modules? Gezzz....

root@:/opt/splunk/share/splunk # cd search_mrsparkle/
root@:/opt/splunk/share/splunk/search_mrsparkle # ls -l
total 12
drwxr-xr-x 12 root wheel 512 May 26 19:46 exposed
drwxr-xr-x 16 root wheel 512 May 26 19:46 modules.new
drwxr-xr-x 37 root wheel 1024 May 26 19:46 templates

A simple fix and I'm now up and running:

root@:/opt/splunk/share/splunk/search_mrsparkle # cp -r modules.new/ modules

root@:/opt/splunk/share/splunk/search_mrsparkle # /opt/splunk/bin/splunk start

Splunk> Now with more code!

Checking prerequisites...

    Checking http port [8000]: open

    Checking mgmt port [8089]: open

    Checking configuration...  Done.

    Checking critical directories...        Done

    Checking indexes...

            Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary

    Done

    Checking filesystem compatibility...  Done

    Checking conf files for problems...

    Done

All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Done

Starting splunkweb... Done

If you get stuck, we're here to help.

Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://DOMAIN_NAME:8000

topic Re: Unable to start splunkweb in Security

Unable to start splunkweb

Re: Unable to start splunkweb