topic Re: Splunk not starting with 8089 in Splunk Enterprise

Splunk not starting with 8089

project9433 — Wed, 01 Nov 2017 20:23:59 GMT

Recently I had installed splunk 6.5.1 in a new box and I wanted to configure that as Indexer instance. So that later I can include it in an Indexer cluster. Now after accepting license, splunk is not getting started. It says the management 8089 is used and do you want to change the port . I thoroughly checked with the Linux team and myself the port is not used-up, but still the Splunk is not able to start with the port 8089.

One strange observation was, immediately after I accept splunk and start it, then I get 8089 port issues pop-up. Now the very next moment, I did netstat the 8089 was shown as used up by my Deployment server. After 5 sec I did again the netstat the port was shown as unused. Though I have no setting for Depl server in my new Indexer box.

It is like stomping, the splunk tries to start using 8089 and then says it is used up(none other than splunk) and then after few min I dont see the port used anymore (splunk releases the port)

Re: Splunk not starting with 8089

ryanhast — Wed, 01 Nov 2017 21:32:01 GMT

Make sure that your server is not also running a Splunk forwarder.
1. Uninstall then reinstall Splunk.

Re: Splunk not starting with 8089

10306629 — Thu, 02 Nov 2017 10:17:15 GMT

yes i have reinstall splunk but still the Splunk is not able to start with the port 8089

Re: Splunk not starting with 8089

hardikJsheth — Thu, 02 Nov 2017 12:05:49 GMT

Did you make any change to any of the configurations files in Splunk before starting??

Re: Splunk not starting with 8089

project9433 — Mon, 06 Nov 2017 16:52:51 GMT

Yes, I did realize after reading this post that there was a splunkforwarder running in the box. After I stopped it, I was able to run splunk with 8089 port. The strange thing was, the netstat did not show the port usage by forwarder. Anyways, Thanks you Ryan you rock!