Splunk weburl is not comingup up after installation on UF.
Splunk enterprise on Linux A(weburl)
UF INSTALLED ON lINUX B
This happens when you accidentally turn off the management interface. You can look for this with either of these 2 commands:
find /opt/splunk/etc/ -type f -name server.conf -exec grep -il disableDefaultPort {} \;
/opt/splunk/bin/splunk btool server list --debug | grep disableDefaultPort
To brute force a quick-fix until you sort out your configuration files, just put this in /opt/splunk/etc/system/local/server.conf
:
[httpServer]
disableDefaultPort = false
Then restart Splunk.
To add insult to injury, neither the splunk logs, nor the dead page served to you give you any indication that this is the situation and either could and BOTH SHOULD. Even when we turned on debug with /opt/splunk/bin/splunk start --debug
, we STILL do not get any log telling us that this setting has explicitly disabled this core function. The ONLY place that you see this, and the only reason that we figured it out, is that it IS logged to stdout
when you start splunk. You will see this somewhat casual note:
$ /opt/splunk/bin/splunk start
Splunk> All batbelt. No tights.
Checking prerequisites...
Management port has been set disabled; the web UI cannot work.
Checking http port [8000]: open
Management port has been set disabled; cli support for this configuration is currently incomplete.
I opened a P4/ER to have this logged as a WARN but who knows if this will ever get implemented. Hopefully this answer will save somebody the day that I wasted on this. To be fair, it was my own fault; I was hardening UFs and did not have my blacklist correct for my server class so it hit a few of my Search Heads. DOH!
Not sure what you are trying to say. Please provide accurate details. UF installation and http://localhost:8000 not coming up, have nothing to do with each other as both are on separate machines.
After whatever you do as @skoelpin mentioned When u confirm http://localhost:8000 is UP locally" and then when u need to access the URL from other systems u may need to configure your Linux Firewall settings on Splunk Server to allow connection to Port 8000.
Hi Neeraj,
Q>Not sure what you are trying to say. Please provide accurate details. UF installation and http://localhost:8000 not coming up, have nothing to do with each other as both are on separate machines.
A> After UF installed on Linux B, Splunk weburl not comingup @ Linux A(index server) http://localhost:8000, this url was up before installing UF on lINUX B.
What do the logs say? Have you triedhttps://localhost:8000
?
Did you change the port during installation?
Tried https://localhost:8000 but weburl is not coming up.
Did you change the port during installation?
No
There is no web interface for universalforwarder.
Can i have your number please, i am in US, want to discuss on this issue.
Thanks,
Yes, There is no web interface for universalforwarder.
I am checking on index server where splunk enterprises installed (http://hostname:8000)
I think I misinterpreted your questions. What happens when you run ./splunk status? Did you try restarting splunk ?
Can i have your contact number?
After running .splunk status its show
splunkd is running (PID: 16411).
splunk helpers are running (PIDs: 16420 16411).
embracing, see comment below, did not read the question 100%
the UF has no web interface
Hi Adonio,
Yes, UF has no web interface, i am saying about Index server were i installed splunk enterprise.
Thanks
I did try http://localhost:8000, but it not coming up, before UF installation it was up.