Archive

Splunk Enterprise : Weburl not coming up (http://hostname:8000)

Explorer

Splunk weburl is not comingup up after installation on UF.

Splunk enterprise on Linux A(weburl)
UF INSTALLED ON lINUX B

Tags (1)

Esteemed Legend

This happens when you accidentally turn off the management interface. You can look for this with either of these 2 commands:

find /opt/splunk/etc/ -type f -name server.conf -exec grep -il disableDefaultPort {} \;
/opt/splunk/bin/splunk btool server list --debug | grep disableDefaultPort

To brute force a quick-fix until you sort out your configuration files, just put this in /opt/splunk/etc/system/local/server.conf:

[httpServer]
disableDefaultPort = false

Then restart Splunk.
To add insult to injury, neither the splunk logs, nor the dead page served to you give you any indication that this is the situation and either could and BOTH SHOULD. Even when we turned on debug with /opt/splunk/bin/splunk start --debug, we STILL do not get any log telling us that this setting has explicitly disabled this core function. The ONLY place that you see this, and the only reason that we figured it out, is that it IS logged to stdout when you start splunk. You will see this somewhat casual note:

$ /opt/splunk/bin/splunk start

Splunk> All batbelt. No tights.

Checking prerequisites...
        Management port has been set disabled; the web UI cannot work.
        Checking http port [8000]: open
        Management port has been set disabled; cli support for this configuration is currently incomplete.

I opened a P4/ER to have this logged as a WARN but who knows if this will ever get implemented. Hopefully this answer will save somebody the day that I wasted on this. To be fair, it was my own fault; I was hardening UFs and did not have my blacklist correct for my server class so it hit a few of my Search Heads. DOH!

Path Finder

Not sure what you are trying to say. Please provide accurate details. UF installation and http://localhost:8000 not coming up, have nothing to do with each other as both are on separate machines.

After whatever you do as @skoelpin mentioned When u confirm http://localhost:8000 is UP locally" and then when u need to access the URL from other systems u may need to configure your Linux Firewall settings on Splunk Server to allow connection to Port 8000.

0 Karma

Explorer

Hi Neeraj,

Q>Not sure what you are trying to say. Please provide accurate details. UF installation and http://localhost:8000 not coming up, have nothing to do with each other as both are on separate machines.
A> After UF installed on Linux B, Splunk weburl not comingup @ Linux A(index server) http://localhost:8000, this url was up before installing UF on lINUX B.

0 Karma

SplunkTrust
SplunkTrust

What do the logs say? Have you triedhttps://localhost:8000 ?

Did you change the port during installation?

0 Karma

Explorer

Tried https://localhost:8000 but weburl is not coming up.

Did you change the port during installation?
No

0 Karma

Influencer

There is no web interface for universalforwarder.

0 Karma

Explorer

Can i have your number please, i am in US, want to discuss on this issue.

Thanks,

0 Karma

Explorer

Yes, There is no web interface for universalforwarder.
I am checking on index server where splunk enterprises installed (http://hostname:8000)

0 Karma

Influencer

I think I misinterpreted your questions. What happens when you run ./splunk status? Did you try restarting splunk ?

0 Karma

Explorer

Can i have your contact number?

0 Karma

Explorer

After running .splunk status its show

splunkd is running (PID: 16411).
splunk helpers are running (PIDs: 16420 16411).

0 Karma

SplunkTrust
SplunkTrust
0 Karma

SplunkTrust
SplunkTrust

embracing, see comment below, did not read the question 100%
the UF has no web interface

0 Karma

Explorer

Hi Adonio,

Yes, UF has no web interface, i am saying about Index server were i installed splunk enterprise.

Thanks

0 Karma

Explorer

I did try http://localhost:8000, but it not coming up, before UF installation it was up.

0 Karma