All Apps and Add-ons

Can't access web interface due to ExecProcessor error.

sainzu
Explorer

I am unable to access the web interface anymore. Firefox displays "The connection was reset" error.

I looked at splunkd.log and found following errors reported in excess of multiple times:

05-24-2011 16:27:49.484 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/interfaces.sh" awk: line 1: syntax error at or near ,
05-24-2011 16:27:49.484 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/interfaces.sh" awk: line 1: syntax error at or near else
05-24-2011 16:27:49.484 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/interfaces.sh" awk: line 1: syntax error at or near }

Can anyone point me to a solution? Not sure what went wrong. This installation was working fine few weeks ago.

Splunk is installed in a debian box running apache2.

dwaddle
SplunkTrust
SplunkTrust

I would say on the surface the two are not related. The ExecProcessor errors are from a splunkd scripted input. The web interface (Splunkweb) runs in a different process than splunkd. I would probably start with these:

  1. Is splunkweb running? ps -ef | grep mrsparkle
  2. Is splunkweb listening on the expected port? netstat -antp | egrep LISTEN.*python
  3. Is there anything interesting in splunkweb.log?

Firefox also displays this error if you try to access and HTTPS-enabled splunkweb using an http:// URL. If your splunkweb is configured to use HTTPS, make sure you are using an https:// URL.

dwaddle
SplunkTrust
SplunkTrust

y'welcome -- if you would, please mark the answer as "accepted" by clicking the little checkbox on the left. That'll take it out of the unanswered list.

0 Karma

sainzu
Explorer

That was it. It works on https. I never noticed whether Splunk ran on https or http before. I have never made any changes to that configuration anytime.

Thanks a lot for your help mr.dwaddle 🙂

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Odd question - did someone configure SplunkWeb to use SSL? I get the same "The connection was reset" out of firefox when I try to access my https splunkweb with an http:// URL.

0 Karma

sainzu
Explorer

I don't see anything alarming in web_access.log and web_service.log. Any other way to trouble shoot this problem?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Ah, I had the logfile names wrong. My apologies. The interesting logs would be web_access.log and web_service.log.

sainzu
Explorer

Here are the results:

debian:/opt/splunk/var/log/splunk# ps -ef | grep mrsparkle
root     19137     1  0 16:24 ?        00:00:02 python -O /opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/root.py start
root     26650  4181  0 16:48 pts/0    00:00:00 grep mrsparkle

debian:/opt/splunk/var/log/splunk# netstat -antp | egrep LISTEN.*python
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      19137/python

I dont see a splunkweb.log but if you mean ../var/log/splunk/web_access.log, the last logged message is from Apr 20. That's probably when I check it last.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...