topic Re: APPSERVER_PORT_ZERO - Warning Message in Splunk Search

APPSERVER_PORT_ZERO - Warning Message

mtaher — Sun, 04 Oct 2020 14:08:58 GMT

I have Splunk version: 7.3.1 and I see the message: APPSERVER_PORT_ZERO

The value for: "appServerPorts" is set to 0, I get this message. I have tried with many different combinations like:

"appServerPorts = 0", I get an warning message
If I comment out that line in local/web.conf, then the values in default/web.conf is used, and splunkweb does not start
If I comment them out in both places, I get a warning about "appServerPorts = 0".
If I set "appServerPorts = 8065" or some other unused value, splunkweb did not start

I have attached a screenshot of the error message. Any inputs would be appreciated.

Re: APPSERVER_PORT_ZERO - Warning Message

richgalloway — Mon, 05 Oct 2020 12:55:24 GMT

The cited error message says the messages.conf file (not web.conf) is incorrect. If you have modified that file, undo your changes. If you have not modified that file, restore the original $SPLUNK_HOME/etc/system/default/messages.conf from backup or the original distribution.

Re: APPSERVER_PORT_ZERO - Warning Message

mtaher — Mon, 12 Oct 2020 15:09:13 GMT

@richgalloway Thank you for the suggestion. I had not made any changes to the file, however I tried to replace the file "messages.conf" from other installs the error remains. Can you please share a screenshot of the "[APPSERVER:APPSERVER_PORT_ZERO]" in the messages.conf file to see if it misses some content.

Re: APPSERVER_PORT_ZERO - Warning Message

richgalloway — Mon, 12 Oct 2020 16:59:50 GMT

Here is the stanza in my messages.conf file (Splunk 8.0.6).

Re: APPSERVER_PORT_ZERO - Warning Message

mtaher — Mon, 26 Oct 2020 14:04:33 GMT

I reinstalled the entire system and now I'm getting the below error I described in the original post:

"Appserver: Running Splunk Web in legacy mode by setting appServerPorts=0 has been deprecated."

If I comment out that line in local/web.conf, then the values in default/web.conf is used, and splunkweb does not start
If I comment them out in both places, I get a warning about "appServerPorts = 0".
If I set "appServerPorts = 8065" or some other unused value, splunkweb did not start

Any thoughts would be helpful.

Re: APPSERVER_PORT_ZERO - Warning Message

richgalloway — Mon, 26 Oct 2020 15:58:10 GMT

What version of Splunk are you using?

The value of appServerPorts in etc/system/default/web.conf should be correct and allow Splunk to start.

Use btool to see if the value is being set by another app.

splunk btool --debug web list | grep appServerPorts

Re: APPSERVER_PORT_ZERO - Warning Message

mtaher — Mon, 26 Oct 2020 16:01:32 GMT

Splunk version is 7.3.1

Re: APPSERVER_PORT_ZERO - Warning Message

mtaher — Mon, 26 Oct 2020 16:48:53 GMT

Splunk version is: 7.3.1

The result of the above command is:

/usr/local/share/voxeo/splunk/etc/system/local/web.conf appServerPorts = 0

No other app is making changes to it. Not sure where else to look.

Re: APPSERVER_PORT_ZERO - Warning Message

richgalloway — Mon, 26 Oct 2020 17:16:54 GMT

There must be a line in /usr/local/share/voxeo/splunk/etc/system/default/web.conf that also sets that attribute to 8065. It's absence probably is what is keeping Splunk from starting.

You say you recently re-installed Splunk so I'm surprised this setting is missing and it makes me wonder what else is missing. Did you re-download the installer when you re-installed Splunk?

Do you have another instance of the same version from which you can copy web.conf?

Re: APPSERVER_PORT_ZERO - Warning Message

mtaher — Tue, 03 Nov 2020 13:04:17 GMT

There is a line in default/web.conf that has the value appServerPorts=8065, I still get the error

I had a copy of the Splunk installer on the system and used the same one. I need to check if I have another server with the same version.

Re: APPSERVER_PORT_ZERO - Warning Message

richgalloway — Tue, 03 Nov 2020 13:35:36 GMT

The setting in default/web.conf is as it should be and Splunk should run with that setting.
Have you considered using a different version of Splunk?

Re: APPSERVER_PORT_ZERO - Warning Message

mtaher — Tue, 03 Nov 2020 14:10:04 GMT

I can try that and let you know the results.