topic Re: Winsock error 10061 while opening Splunk web in Security

Winsock error 10061 while opening Splunk web

siva_cg — Tue, 29 Sep 2020 19:57:30 GMT

Hi Team,

I am trying to install Splunk Enterprise 7.1.1 on my local windows 10 machine and on board some of the security data for analysis. I have installed it as documented but unable to open the Splunk web and facing below error while opening.

This XML file does not appear to have any style information associated with it. The document tree is shown below.

Error connecting: Winsock error 10061

I have checked the documents and Splunk community for any solution but didn't find any relevant answers. Hope you could help to resolve the issue. Thanks in advance.

Few extracts from the Splunkd.log and web_service.log

06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" Traceback (most recent call last):
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py", line 66, in
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" from splunk_instrumentation.input import run_input # noqa: E402
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\splunk_instrumentation\input.py", line 13, in
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" from schedule_manager import ScheduleManager
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\splunk_instrumentation\schedule_manager.py", line 4, in
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" from splunk_instrumentation.packager import Packager
06-10-2018 23:00:02.536 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\splunk_instrumentation\packager_init_.py", line 3, in

2018-06-10 22:30:54,345 ERROR [5b1d5943d72239cf6a080] root:825 - Unable to start splunkweb
2018-06-10 22:30:54,346 ERROR [5b1d5943d72239cf6a080] root:826 - invalid syntax (enum.py, line 265)
Traceback (most recent call last):
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 102, in
from controllers.top import *
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\controllers\top.py", line 30, in
from proxy import ProxyController

Re: Winsock error 10061 while opening Splunk web

Azeemering — Mon, 11 Jun 2018 09:26:17 GMT

Can you check if the Splunkd Service is running? (Search and type services.msc)

Winsock error 10061:
Connection refused.
No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host—that is, one with no server application running.

So either it loos like the service is not running or you have some sort of permission issue on your Windows10 install.

Re: Winsock error 10061 while opening Splunk web

siva_cg — Mon, 11 Jun 2018 10:57:20 GMT

Hi @Azeemering,

Thank you for your response. Splunk service is running. I have installed Splunk as local user with admin privileges.

Re: Winsock error 10061 while opening Splunk web

Azeemering — Mon, 11 Jun 2018 11:07:32 GMT

Do you have a local install of python by any chance?
Make sure there is no locally installed Python presented to Splunk as a default (environment variables etc.).

Re: Winsock error 10061 while opening Splunk web

siva_cg — Mon, 11 Jun 2018 11:17:11 GMT

Hi @Azeemering,

Yes, I have Python installed on my local machine and environment variable specified. What will be solution in this case? Do I need to remove Python variable? Thanks in advance.

Re: Winsock error 10061 while opening Splunk web

Azeemering — Mon, 11 Jun 2018 11:20:55 GMT

You need to uninstall python I guess...the versions are conflicting eachother and causing this issue.
Or you could try and play around with the Variables.
Splunk comes packaged with Python version 2.7

Re: Winsock error 10061 while opening Splunk web

siva_cg — Mon, 11 Jun 2018 11:53:34 GMT

Thank you. I will try to play with variables first and if not succeeded, I will uninstall Python. Thank you very much once again.

Re: Winsock error 10061 while opening Splunk web

nhvardhan58 — Wed, 05 Sep 2018 07:49:07 GMT

Hi All,

I am facing the same error, i do not have python Installed on the server. What would be the solution.

Re: Winsock error 10061 while opening Splunk web

RAVIKR — Fri, 07 Sep 2018 03:51:44 GMT

HOw did you resolve this issue?

Re: Winsock error 10061 while opening Splunk web

nhvardhan58 — Fri, 07 Sep 2018 04:48:33 GMT

Can anybody help by letting us know how did this issue get resolved.

Re: Winsock error 10061 while opening Splunk web

nhvardhan58 — Fri, 07 Sep 2018 04:49:23 GMT

I am facing the same error, i do not have python Installed on the server. What would be the solution.

Can anybody help to resolve the issue.

Re: Winsock error 10061 while opening Splunk web

nhvardhan58 — Fri, 07 Sep 2018 04:49:31 GMT

I am facing the same error, i do not have python Installed on the server. What would be the solution.

Can anybody help to resolve the issue.

Re: Winsock error 10061 while opening Splunk web

dchoi_splunk — Fri, 15 Mar 2019 02:34:13 GMT

If the Splunkd Service is running but unable to start web service in Windows or Linux

Check if the web-port configured is open and listening on the instance(sometimes another process is bound to the port)
Check if any firewall rule has been enabled to block
Check if Certificates and SSL is working as expected then try to restart with disabled WebSSL under web.conf to isolate the issue [settings] enableSplunkWebSSL = false
Check if any AV(Antivirus) product is running on the server. https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts

When you run Splunk (Enterprise or forwarder) on a host that has an anti-virus product (such as McAfee VirusScan on Windows or Trend Micro ServerProtect on Linux) installed, Splunk strongly recommends that you exclude all Splunk processes as well as the Splunk installation directory from any kind of on-access scanning.

Splunkd is running but once you try to restart the web service via CLI, you might come across below response:

C:\Program Files\Splunk\bin>splunk restart splunkweb
502 Couldn't complete HTTP request: Winsock error #10061
Or
A server is busy message on HttpListener channel in splunkd log

Hope it helps.