topic Re: Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused" in Security

Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused"

att35 — Tue, 29 Sep 2020 15:13:27 GMT

Hi,

Since last 2 days, we have started getting the following error when accessing any of our Splunk URL's.

This is effecting all our instances be it Search Head or Indexer. Nothing can be accessed. We do have a P1 case open with support and they are going through the logs, but I just wanted to put this out there in case anyone else has run into this before.

All our servers are high-spec Physical machines and resource usage is nominal. ulimit is set to a high number and lsof shows the # of open files are not even close to that limit. There were no recent changes/upgrades done to Splunk.
Splunk Version - 6.6.2
Host OS - CentOS 6.9

This is happening for all users irrespective of which browser they use. Cleared browser cache but that didn't help.
no specific errors under splunkd_ui_access.log. For each refresh, this is what we see:

X.X.X.X - - [03/Aug/2017:09:43:43.834 -0400] "GET /favicon.ico HTTP/1.1" 303 397 "https://Splunk_Hostname.x.y.local:8000/en-US/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.109 Safari/537.36" - - 0ms

X.X.X.X - - [03/Aug/2017:09:43:43.836 -0400] "GET /en-US/favicon.ico HTTP/1.1" 502 154 "https://Splunk_Hostname.x.y.local:8000/en-US/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.109 Safari/537.36" - - 0ms

Is there anything else that I can check to isolate where the issue is?

Many Thanks,

~ Abhi

Re: Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused"

esircti — Wed, 09 Aug 2017 20:05:45 GMT

Hi,

I'm with the same problem.
Host Ubuntu 14.04.

I Open a case at support portal and I'm waitin for response.

Re: Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused"

esircti — Fri, 11 Aug 2017 14:13:54 GMT

Hi,

Try

Inside $SPLUNK_HOME/bin

./splunk restartss

Re: Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused"

att35 — Mon, 14 Aug 2017 14:38:03 GMT

Hi esircti,

Yes. That's the solution we got as well from Support and did resolve our issue. I hope this helps others on this forum.

Thanks,

~ Abhi

Re: Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused"

esircti — Mon, 14 Aug 2017 17:10:42 GMT

Did not work for me too.

I'm waiting for other solution.

Re: Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused"

esircti — Tue, 15 Aug 2017 21:25:19 GMT

Hi,

I try first to downgrade 6.6.2 to 6.2.1. It still not working.
So, I downgraded to 6.5.5 and the interface cameback.

I did it at my risk. I did not wait for the Support.

Now I'll wait for the answer to try the new version.

Re: Cannot Access Splunk UI. Getting XML error for "Error connecting: Connection refused"

murdoctx — Mon, 30 Mar 2020 15:58:02 GMT

I found that in windows you go into windows services and restart splunkd.