topic Re: splunk could start due to splunkweb time out help !! in Installation

splunk could start due to splunkweb time out help !!

HelpMePlease — Wed, 24 Jul 2013 15:18:34 GMT

I used cmd to restart splunk but splunkweb time out. I only know how to restart using cmd as I saw some people say:

1 stop splunk
2 check the presence and owner/permissions on $SPLUNK_HOME/var/run/splunk/*.pid
3 delete them if they still exists
4 if needed do a chown -R for the splunk folders to change the owner
5 start splunk under the correct user
6 double check that the service starts with the correct user

How can I start ? How do I solve it. I don't know how to chown -R and start splunk under correct user. Anyone can teach me in detail way ? After using CCleaner, I could not even start localhost:8000. I only can use localhost:8000, whenever I use the web it direct me to a strange ip that splunk could not start.

But the main problem is how I can troubleshoot or debug to make my splunk work. I believe is CCleaner that cause the problem.

Re: splunk could start due to splunkweb time out help !!

linu1988 — Wed, 24 Jul 2013 20:22:25 GMT

Was it running before?
If you want to start the service

go to splunk_home/bin
splunk start/restart.

And you dont have to worry about the chown command. In windows it's flexible. Run it under administrator/if you have any other account to run under. Thanks.

Re: splunk could start due to splunkweb time out help !!

HelpMePlease — Thu, 25 Jul 2013 00:39:11 GMT

yes it is running before, I went to cmd to do a splunk restart, the splunkd is start while splunkweb timed out.

Re: splunk could start due to splunkweb time out help !!

KarunK — Thu, 25 Jul 2013 01:00:04 GMT

You can check the "/opt/splunk/var/log/splunk/splunkd.log" for more clues. In most cases it will be help full.

Stop the splunk.
Check all the splunk process are killed.
Check the permissions and ownership of the splunk chown -R root:root /opt/splunk chmod -R 777 root
If you are running splunk as non-root user follow the document below. http://docs.splunk.com/Documentation/Splunk/latest/Installation/RunSplunkasadifferentornon-rootuser
Then start the splunkd process first and then splunkweb

Hope this helps

Re: splunk could start due to splunkweb time out help !!

HelpMePlease — Thu, 25 Jul 2013 02:27:00 GMT

Solved by uninstall and installing Splunk again. Took risk to retain data in C:\Program Files\Splunk\var\lib\splunk\defaultdb\db then replace db in new Splunk. Luckily my data is still inside new Splunk. Cheers !