topic Re: Problem Starting Splunk web after enabling light forwarding in Security

Problem Starting Splunk web after enabling light forwarding

misteryuku — Tue, 17 Apr 2012 07:46:26 GMT

Ever since i enabled light forwarding, i couldn't launch splunk web as normal. i double clicked the splunk.exe in windows 7 and there was this command line window that says.

Launching web browser pointing at SplunkWeb

waiting for splunk web to start.....

I have been waiting for a long time but the splunk web doesn't launch. How am i supposed to launch Splunk web now?????

Re: Problem Starting Splunk web after enabling light forwarding

MHibbin — Tue, 17 Apr 2012 08:22:53 GMT

Misteryuku,

When you enable SplunkLightForwarding, Splunk will change a configuration in one of the conf files to disable Splunk web. I don't think the starting splunkweb will work (tried it on my machine and it didn't work anyway). SplunkLightForwarding is basically an App, so it can be disabled (which will re-enable splunkweb).

To see the full output of CMD commands, you may need to CMD as administrator (e.g. right-click the CMD icon and select "run as administrator". Be careful of making other changes!

If you change to the Splunk bin directory (for example on my laptop this is "C:\Program Files\Splunk\bin") for example:

cd \Program Files\Splunk\bin

I would the run the following command to disable the app:

splunk.exe disable app SplunkLightForwarder

You will then need to restart splunk:

splunk.exe restart

... I followed that process and it worked for me.

Regards,

MHibbin

Re: Problem Starting Splunk web after enabling light forwarding

misteryuku — Tue, 17 Apr 2012 08:41:08 GMT

i uninstalled Splunk and reinstalled Splunk before you replied me. i didn't mind uninstalling splunk and i am alright at resuming Splunk at its default state. The info you gave me would come in handy for me. Thanks.