topic Re: Startwebserver 0 in Deployment Architecture

Startwebserver 0

Laurence — Tue, 16 Nov 2021 21:56:02 GMT

When I start Splunk after a reboot of the server splunk is running fine but the webserver is not starting.

./splunk cmd btool web list --debug |grep startwebserver
/opt/splunk/etc/apps/SplunkLightForwarder/default/web.conf startwebserver = 0

Is there a way to manualy start the webserver? I run Ubuntu

Thanks,
Laurence

Re: Startwebserver 0

badrinath_itrs — Tue, 16 Nov 2021 22:17:39 GMT

The Webserver gets restarted automatically if that is enabled as startwebserver =1 in web.conf.

Can you check if you have a file in $SPLUNK_HOME/etc/system/local/web.conf that disable the webserver ? if not create a file and enable the settings ?

Re: Startwebserver 0

Laurence — Tue, 16 Nov 2021 23:29:05 GMT

The file web.conf isn't there. Also I dont realy know what to put in the file when I create it.

Re: Startwebserver 0

badrinath_itrs — Tue, 16 Nov 2021 23:39:17 GMT

If this enterprise SPLUNK installation , it should be enabled in web.conf in $SPLUNK_HOME/etc/system/default.

You can try adding below settings in $SPLUNK_HOME/etc/system/local/web.conf

[settings] startwebserver = 1

Re: Startwebserver 0

Laurence — Tue, 16 Nov 2021 23:39:55 GMT

I got it fixed, found the settings for the file in the splunk documentation. Thank you for you help.

Re: Startwebserver 0

isoutamo — Wed, 17 Nov 2021 08:56:58 GMT

BTW, if this is a peer in indexer cluster or heavy forwarder then it's best practice to keep web GUI down for security reasons.
https://docs.splunk.com/Documentation/Splunk/8.2.3/Security/WhatyoucansecurewithSplunk