topic Re: Splunk on RHEL9 won't start in Installation

Splunk on RHEL9 won't start

atr — Tue, 23 Jul 2024 01:21:36 GMT

I have installed Splunk Enterprise on an RHEL9 VM in AWS. I have tried installing via TAR and RPM. I also tried starting it as "root" and "splunk" users but it just won't start. It always hangs at the same point and when that happens I can't even SSH to my VM. I have to reboot the VM to get access to it again.

It stays here for about 30 minutes (maybe longer).

Then, I see the following.

Any idea what might be going on?

Re: Splunk on RHEL9 won't start

deepakc — Tue, 23 Jul 2024 05:32:10 GMT

Start by checking that you have port 8000 available - check firewall ports

The SSH issue is again most likely related to ports/access 22 (but this is not a splunk issue)

Speak to an Linux OS admin, as your issue's seem to be OS config related.

Re: Splunk on RHEL9 won't start

gcusello — Tue, 23 Jul 2024 06:49:20 GMT

Hi @atr ,

as @deepakc said, check and disable the local firewall.

Then see at /opt/splunk/var/log/splunk/first_install.log if something is described.

If you continue to have issues, open a case to Splunk Support, But I'm confident that the issue is the local firewall.

Ciao.

Giuseppe

Re: Splunk on RHEL9 won't start

atr — Tue, 23 Jul 2024 13:29:07 GMT

Thanks for your responses! I do not have a local firewall and SELinux is disabled. I do see "Socket error communicating with splunkd" messages in a couple of logs. I am not sure how to interpret that. Also, there is nothing of relevance in "/opt/splunk/var/log/splunk/first_install.log"

Re: Splunk on RHEL9 won't start

atr — Tue, 23 Jul 2024 15:14:49 GMT

I was able to get it running. The culprit was RAM. I increased it significantly and it is starting up now.

Re: Splunk on RHEL9 won't start

gcusello — Wed, 24 Jul 2024 06:27:21 GMT

Hi @atr ,

check also the other hardware reuirement, to avoid next issues.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉