topic Re: Splunk Heavy Forwarder UI is not loading in Splunk Enterprise

Splunk Heavy Forwarder UI is not loading

Karthikeya — Tue, 16 Sep 2025 13:12:21 GMT

Hello we have installed Akamai add-on on our HF and giving necessary monitor stanzas on its inputs.conf. we are using config explorer where we will perform all on-boarding actions from frontend itself. But somehow our HF UI is not loading at all these days frequently. Rest all components with same config explorer working fine. Not sure what is the issue. There are no errors found in splunkd.log. can someone help me with this?

Re: Splunk Heavy Forwarder UI is not loading

richgalloway — Tue, 16 Sep 2025 14:26:11 GMT

Have you verified the web server is enabled?

splunk btool --debug web list | grep startwebserver

Re: Splunk Heavy Forwarder UI is not loading

Karthikeya — Tue, 16 Sep 2025 13:26:43 GMT

I am running this in bin and no results is coming.

Re: Splunk Heavy Forwarder UI is not loading

Karthikeya — Tue, 16 Sep 2025 13:38:10 GMT

this is happening frequently. Sometimes it will load fine sometimes it won't load like now. When I am checking web_service.log, I see these errors

2025-09-16 13:03:58,859 ERROR [68c960398b7f172e20e210] util:598 - unable to parse embed_uri as URL: Invalid entry for setting : embed_uri 2025-09-16 13:03:58,859 INFO [68c960398b7f172e20e210] root:355 - Proxied mode ip_address=127.0.0.1 port=8065 exposed_port=8443: 2025-09-16 13:03:58,963 INFO [68c960398b7f172e20e210] root:619 - overriding JSON MIME type with 'text/plain; charset=UTF-8' 2025-09-16 13:03:58,971 ERROR [68c960398b7f172e20e210] startup:116 - Unable to read in product version information; isSessionKeyDefined=False error=[HTTP 401] Client is not authenticated

Re: Splunk Heavy Forwarder UI is not loading

Karthikeya — Tue, 16 Sep 2025 14:03:39 GMT

Re: Splunk Heavy Forwarder UI is not loading

richgalloway — Tue, 16 Sep 2025 14:26:26 GMT

I fixed the command.

Re: Splunk Heavy Forwarder UI is not loading

Karthikeya — Tue, 16 Sep 2025 14:52:53 GMT

/opt/splunk/etc/system/default/web.conf startwebserver = 1

UI loaded till yesterday but we have this issues frequently. Not sure what's the issue is.

Re: Splunk Heavy Forwarder UI is not loading

squinlan2 — Wed, 17 Sep 2025 19:15:10 GMT

Although it probably doesn't explain the intermittent nature of the problem, I've seen fapolicyd interfere with some Splunk Add-On UI pages. If this were the case you would need to configure an fapolicyd exception. You can audit fapolicyd using the command: sudo /usr/sbin/fapolicyd --debug-deny

Hope this helps!