500 error after splunk reboot

Bulluk — Wed, 07 Dec 2011 12:33:52 GMT

I added a mailhost to splunk and then rebooted as per the notice at the top of the page. When it came back up I got the usual login screen but after login in as the admin account I was greeted with the following error:

InternalServerError: [HTTP 500] Splunkd internal error; [{'text': "In handler 'user-prefs': Application does not exist: user-prefs", 'code': None, 'type': 'ERROR'}]

I've compared the /etc/users directory to a working instance of splunk and can't see any differences. I've checked that the /etc/apps/user-prefs application exists and again it's identical to a working server.

At this point, as a Splunk newb I don't really know what else to look for so any help is really appreciated!

I'm running Splunk 4.2.4 on a Windows 2008 machine

Thanks

Re: 500 error after splunk reboot

Bulluk — Thu, 15 Dec 2011 12:20:06 GMT

My problem turned out to be a daft one. For reasons that I won't bore you with I have splunk universal forwarder AND the full version of splunk on the same server. As a result, when I performed a restart of splunkweb there was a chance that it would bind to the forwarder port rather than the full instance. The fix was to simply move one of them to another port, ie I now have the forwarder on 8090 and the full instance is on 8091

topic 500 error after splunk reboot in Getting Data In

500 error after splunk reboot

Re: 500 error after splunk reboot