https://community.splunk.com/t5/Security/Azure-Splunk-Enterprise-web-interface-doesn-t-restart/m-p/386411#M9453 <P>Disclaimer: I'm a Ubuntu and Splunk administration novice.</P> <P>This is the 4th time I spun up a Splunk Enterprise instance in Azure (see <A href="https://azuremarketplace.microsoft.com/en-us/marketplace/apps/splunk.splunk-enterprise" target="_blank">https://azuremarketplace.microsoft.com/en-us/marketplace/apps/splunk.splunk-enterprise</A>). The 3 most recent times worked great the first time I used them but if I shut down the instance (to save $) and restart it a subsequent day, I cannot reach the web interface. The browser responds with "ERR_CONNECTION_REFUSED".</P> <P>I can SSH into the machine just fine, but I do not see a Splunk service running using <CODE>service --status-all</CODE>. Not sure if I should. If I try <CODE>./splunk restart</CODE> I get "ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment" which makes me suspect I'm not trying to restart under the correct account. </P> <P>Any ideas on how to troubleshoot this instance, restart Splunk, and/or find out what's wrong with this Azure image would be appreciated.</P> Tue, 29 Sep 2020 22:00:13 GMT edupuis_incomm 2020-09-29T22:00:13Z https://community.splunk.com/t5/Security/Azure-Splunk-Enterprise-web-interface-doesn-t-restart/m-p/386411#M9453 <P>Disclaimer: I'm a Ubuntu and Splunk administration novice.</P> <P>This is the 4th time I spun up a Splunk Enterprise instance in Azure (see <A href="https://azuremarketplace.microsoft.com/en-us/marketplace/apps/splunk.splunk-enterprise" target="_blank">https://azuremarketplace.microsoft.com/en-us/marketplace/apps/splunk.splunk-enterprise</A>). The 3 most recent times worked great the first time I used them but if I shut down the instance (to save $) and restart it a subsequent day, I cannot reach the web interface. The browser responds with "ERR_CONNECTION_REFUSED".</P> <P>I can SSH into the machine just fine, but I do not see a Splunk service running using <CODE>service --status-all</CODE>. Not sure if I should. If I try <CODE>./splunk restart</CODE> I get "ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment" which makes me suspect I'm not trying to restart under the correct account. </P> <P>Any ideas on how to troubleshoot this instance, restart Splunk, and/or find out what's wrong with this Azure image would be appreciated.</P> Tue, 29 Sep 2020 22:00:13 GMT https://community.splunk.com/t5/Security/Azure-Splunk-Enterprise-web-interface-doesn-t-restart/m-p/386411#M9453 edupuis_incomm 2020-09-29T22:00:13Z