topic Re: Blank Login Page in Installation

Blank Login Page

HMRCSplunk — Wed, 10 Jan 2018 16:29:10 GMT

Hi,

So I have just installed splunk for the first time on my linux ubuntu machine. The only changes I have made during configuration is I have changed the HTTPS port in the web.conf file so that it uses port 12300 instead of 8000 port 8000 is being used by another program). I start splunk like usual and the output says that the ports are open and available to use and then links me the page of the splunk interface. When I click on the link it opens in my firefox browser and directs to the splunk web interface log in page. However nothing is displayed on the page.

I know that the web page is working correctly apart from its blank. The URL file structure changes to the log in page directory and I can also view the page source which is populated with what should be shown on the web page. I have also ran through the log files and there are no errors there either. Everything I have looked at looks like it should be running smoothly but it isnt. I have tried solutions on the internet like stopping iptables from running at the same time but I dont have iptables setup so this is not an cause.

If anyone has had and fixed this problem then please could you enlighten me as I feel like I have hit a brick wall with trying to install this.

Cheers

Re: Blank Login Page

mayurr98 — Wed, 10 Jan 2018 18:56:53 GMT

hey try opening ports in linux firewall
https://www.tixati.com/optimize/open-ports-linux.html

let me know if this helps !

Re: Blank Login Page

aljohnson_splun — Wed, 10 Jan 2018 19:28:59 GMT

do you see the same results on different browsers, with browser extensions off, and after clearing your web caches? are there http errors when you open the dev console in your browser?

Re: Blank Login Page

HMRCSplunk — Thu, 11 Jan 2018 11:03:29 GMT

Thanks for the reply.
I have tried running on firefox and chrome, both blank. I have turned off extensions and cleared web cache and still nothing.

This is the output i got from the dev console running on firefox:

Could not read chrome manifest 'file:///usr/lib/firefox/chrome.manifest'.
The resource from “http://phishingpc-esprimo-c700:12300/en-GB/static/@7F44362F43575C23315E176660629FD2339C79AAD3986A3FD44E81AF17527B02/build/css/bootstrap-enterprise.css” was blocked due to MIME type mismatch (X-Content-Type-Options: nosniff).Learn More
The resource from “http://phishingpc-esprimo-c700:12300/en-GB/static/@7F44362F43575C23315E176660629FD2339C79AAD3986A3FD44E81AF17527B02/build/pages/enterprise/account.js” was blocked due to MIME type mismatch (X-Content-Type-Options: nosniff).Learn More
The resource from “http://phishingpc-esprimo-c700:12300/en-GB/static/@7F44362F43575C23315E176660629FD2339C79AAD3986A3FD44E81AF17527B02/build/pages/enterprise/common.js” was blocked due to MIME type mismatch (X-Content-Type-Options: nosniff).Learn More
Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help http://xhr.spec.whatwg.org/ config:1:13
The resource from “http://phishingpc-esprimo-c700:12300/en-GB/static/@7F44362F43575C23315E176660629FD2339C79AAD3986A3FD44E81AF17527B02/build/pages/enterprise/common.js” was blocked due to MIME type mismatch (X-Content-Type-Options: nosniff).Learn More
Loading failed for the

Re: Blank Login Page

p_gurav — Thu, 11 Jan 2018 11:16:55 GMT

Hi HMRCSplunk,

Could you tell me what url you are accessing on browsers ? Try http://localhost:12300 OR https://localhost:12300

Re: Blank Login Page

HMRCSplunk — Thu, 11 Jan 2018 12:00:27 GMT

Hi, I'm accessing the web page by using the link provided by the terminal once you run the command to start the splunk server. So in my case, http://:12300. I have also tried using localhost:12300 and 127.0.0.1:12300 and still both give a blank screen.

Re: Blank Login Page

p_gurav — Thu, 11 Jan 2018 12:03:00 GMT

Hi,
Could you share the screenshot?

Re: Blank Login Page

HMRCSplunk — Thu, 11 Jan 2018 12:13:51 GMT

A screenshot of what? my browser showing a blank screen?

Re: Blank Login Page

p_gurav — Thu, 11 Jan 2018 12:17:18 GMT

Share the web.conf file where you did changed port?

Re: Blank Login Page

HMRCSplunk — Thu, 11 Jan 2018 12:34:51 GMT

[settings]

enable/disable the appserver

startwebserver = 1

port number tag is missing or 0 the server will NOT start an http listener

this is the port used for both SSL and non-SSL (we only have 1 port now).

httpport = 12300

this determines whether to start SplunkWeb in http or https.

enableSplunkWebSSL = false

location of splunkd; don't include http[s]:// in this anymore.

mgmtHostPort = 127.0.0.1:12389

list of ports to start python application servers on (although usually

one port is enough) Set to 0 to instead run the application server

directly as the web front end on 'httpport', separate from splunkd.

appServerPorts = 8066

This is the web.conf file saved in /splunk/etc/system/local.
All I have changed is the httpport and the mgmtHostPort

Re: Blank Login Page

nickhills — Thu, 11 Jan 2018 12:54:12 GMT

You need to also change the splunkd process to use your revised management port.

You can do this via the web ui (which is clearly a non-starter for you) or via the command line.
Use: splunk set splunkd-port 12389 and restart Splunk and try again.

When you set the mgt port in web.conf you are telling the webserver which port splunkd is running on (rather than changing splunkd to use that port) - You have to take this additional step to actually run splunkd on the desired port.

Alternatively, you could change web.conf back to 8089 if this is not also a clash on your system.

http://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Changedefaultvalues#Use_Splunk_CLI

Re: Blank Login Page

HMRCSplunk — Thu, 11 Jan 2018 13:27:47 GMT

Thanks for the reply.

I have ran the command 'splunk set splunkd-port 12389' and restarted and that still doesn't fix the issue.

I have also separately tried changing the web.conf back to 8089 and that also doesn't fix it.

Cheers

Re: Blank Login Page

nickhills — Thu, 11 Jan 2018 13:38:29 GMT

Are you on windows or Linux?

To run the above command you need to specify the path to the Splunk executable.

From a terminal you can cd to the correct location which will be something like (forgive me, I’m a Linux guy)
cd c:\program files\splunk\bin

/opt/splunk/bin on linux

Then you can run the above.
(Prepend the command with./ on a Linux system, eg ./splunk [command])

While your there also run
splunk restart

After it starts up, take a look at the output, about ports and post back here.

Re: Blank Login Page

HMRCSplunk — Tue, 29 Sep 2020 17:37:10 GMT

I am running linux ubuntu. This is the output from restarting splunk:

Checking prerequisites...
Checking http port [12300]: open
Checking mgmt port [12389]: open
Checking appserver port [127.0.0.1:8065]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _internal _introspection _telemetry _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Invalid key in stanza [settings] in /opt/splunk/etc/system/local/web.conf, line 37: xappServerPorts (value: 8066).
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk-7.0.1-2b5b15c4ee89-linux-2.6-i386-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Done

Waiting for web server at http://127.0.0.1:12300 to be available... Done

If you get stuck, we're here to help.

Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://phishingpc-ESPRIMO-C700:12300

EDIT: Output from debugger:

Checking: /opt/splunk/etc/system/local/inputs.conf
No spec file for: /opt/splunk/etc/system/local/migration.conf
Checking: /opt/splunk/etc/system/local/server.conf
Checking: /opt/splunk/etc/system/local/web.conf
Invalid key in stanza [settings] in /opt/splunk/etc/system/local/web.conf, line 37: xappServerPorts (value: 8066).
Did you mean 'x_frame_options_sameorigin'?

Re: Blank Login Page

nickhills — Thu, 11 Jan 2018 13:45:46 GMT

xappServerPorts (value: 8066)

looks like you have a typo (the x) which may be preventing splunk from starting - odd that it would report that it has started though.

If you run netstat -ln|grep 123 do you see entries for your two configured ports?

Re: Blank Login Page

HMRCSplunk — Thu, 11 Jan 2018 13:55:49 GMT

Hi, not sure why but your messages are loading in my emails but not visible on here. I have seen your reply of the spelling error, my bad. However I have removed the x from appserverport and restarted.

The output of a restart shows no errors anymore, but the webpage still shows a blank screen on both localhost:12300, 127.0.0.1:12300 and pcname:12300

Re: Blank Login Page

nickhills — Thu, 11 Jan 2018 13:58:47 GMT

right, so you dont see a line which says 127.0.0.1:12389 ?

Can you take a look in /opt/splunk/var/log/splunk/splunkd.log and post the last 50 or so lines?

Re: Blank Login Page

HMRCSplunk — Tue, 29 Sep 2020 17:37:16 GMT

01-11-2018 13:50:59.218 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/introspection/db
01-11-2018 13:50:59.222 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/introspection/kvstore.log'.
01-11-2018 13:50:59.231 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/introspection/http_event_collector_metrics.log'.
01-11-2018 13:50:59.246 +0000 INFO WatchedFile - Will begin reading at offset=467998 for file='/opt/splunk/var/log/introspection/disk_objects.log'.
01-11-2018 13:50:59.253 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/remote_searches.log'.
01-11-2018 13:50:59.294 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/django_error.log'.
01-11-2018 13:50:59.301 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/searchhistory.log'.
01-11-2018 13:50:59.361 +0000 INFO IndexWriter - Creating hot bucket=hot_v1_14, idx=_internal, event timestamp=1515678649, reason="suitable bucket not found, number of hot buckets=0, max=3"
01-11-2018 13:50:59.362 +0000 INFO DatabaseDirectoryManager - idx=_internal Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db', pendingBucketUpdates=0 . Reason='Adding bucket, bid=_internal~14~C94310F7-1F65-4765-8582-ED4C5D678114'
01-11-2018 13:50:59.362 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_internaldb/db
01-11-2018 13:50:59.371 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/export_metrics.log'.
01-11-2018 13:50:59.382 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/splunkd_stdout.log'.
01-11-2018 13:50:59.403 +0000 INFO WatchedFile - Will begin reading at offset=24933 for file='/opt/splunk/var/log/splunk/splunkd-utility.log'.
01-11-2018 13:50:59.415 +0000 INFO WatchedFile - Will begin reading at offset=1598 for file='/opt/splunk/var/log/splunk/splunkd_stderr.log'.
01-11-2018 13:50:59.429 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/mongod.log'.
01-11-2018 13:50:59.450 +0000 INFO WatchedFile - Will begin reading at offset=3848 for file='/opt/splunk/var/log/splunk/conf.log'.
01-11-2018 13:50:59.466 +0000 INFO WatchedFile - Will begin reading at offset=1320301 for file='/opt/splunk/var/log/splunk/audit.log'.
01-11-2018 13:50:59.515 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/django_access.log'.
01-11-2018 13:50:59.519 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/django_service.log'.
01-11-2018 13:50:59.725 +0000 INFO DatabaseDirectoryManager - idx=_audit Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/audit/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
01-11-2018 13:50:59.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/audit/db
01-11-2018 13:51:00.243 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=_audit~12~C94310F7-1F65-4765-8582-ED4C5D678114
01-11-2018 13:51:00.372 +0000 INFO ProcessTracker - (child_1Fsck) Fsck - (bloomfilter only) Rebuild for bucket='/opt/splunk/var/lib/splunk/_internaldb/db/db_1515678648_1515678534_13' took 16.08 milliseconds
01-11-2018 13:51:00.725 +0000 INFO DatabaseDirectoryManager - idx=_audit Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/audit/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1'
01-11-2018 13:51:00.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/audit/db
01-11-2018 13:51:01.357 +0000 INFO IntrospectionGenerator:resource_usage - RU_main - I-data gathering (Resource Usage) starting; period=10s
01-11-2018 13:51:01.379 +0000 INFO IntrospectionGenerator:resource_usage - RU_main - I-data gathering (IO Statistics) starting; interval=60s
01-11-2018 13:51:02.325 +0000 INFO ProcessTracker - (child_2_Fsck) Fsck - (bloomfilter only) Rebuild for bucket='/opt/splunk/var/lib/splunk/_introspection/db/db_1515678648_1515678545_12' took 4.254 milliseconds
01-11-2018 13:51:03.243 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=_internal~13~C94310F7-1F65-4765-8582-ED4C5D678114
01-11-2018 13:51:03.725 +0000 INFO DatabaseDirectoryManager - idx=_internal Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1'
01-11-2018 13:51:03.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_internaldb/db
01-11-2018 13:51:04.111 +0000 INFO TelemetryHandler - Telemetry Data Collection has been enabled for app=splunk_instrumentation for categories=License Usage.
01-11-2018 13:51:04.243 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=_introspection~12~C94310F7-1F65-4765-8582-ED4C5D678114
01-11-2018 13:51:04.724 +0000 INFO DatabaseDirectoryManager - idx=_introspection Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_introspection/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1'
01-11-2018 13:51:04.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_introspection/db
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Checking for localhost key pair
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Public key already exists: /opt/splunk/etc/auth/distServerKeys/trusted.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Reading public key for localhost: /opt/splunk/etc/auth/distServerKeys/trusted.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Finished reading public key for localhost: /opt/splunk/etc/auth/distServerKeys/trusted.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Reading private key for localhost: /opt/splunk/etc/auth/distServerKeys/private.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Finished reading private key for localhost: /opt/splunk/etc/auth/distServerKeys/private.pem
01-11-2018 13:51:59.726 +0000 INFO DatabaseDirectoryManager - idx=_internal Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
01-11-2018 13:51:59.726 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_internaldb/db
01-11-2018 13:51:59.727 +0000 INFO DatabaseDirectoryManager - idx=_introspection Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_introspection/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
01-11-2018 13:51:59.728 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_introspection/db

Re: Blank Login Page

HMRCSplunk — Thu, 11 Jan 2018 14:02:59 GMT

Nope there is no line which say 127.0.0.1:12389. There is a line that says 127.0.0.1:8066.

Checking appserver port [127.0.0.1:8066]: open

Re: Blank Login Page

nickhills — Thu, 11 Jan 2018 14:11:28 GMT

Ok, whats in the splunkd.log file?