Installation

Splunk Enterprise : Weburl not coming up (http://hostname:8000)

ahmemohs03
Explorer

Splunk weburl is not comingup up after installation on UF.

Splunk enterprise on Linux A(weburl)
UF INSTALLED ON lINUX B

Tags (1)

woodcock
Esteemed Legend

This happens when you accidentally turn off the management interface. You can look for this with either of these 2 commands:

find /opt/splunk/etc/ -type f -name server.conf -exec grep -il disableDefaultPort {} \;
/opt/splunk/bin/splunk btool server list --debug | grep disableDefaultPort

To brute force a quick-fix until you sort out your configuration files, just put this in /opt/splunk/etc/system/local/server.conf:

[httpServer]
disableDefaultPort = false

Then restart Splunk.
To add insult to injury, neither the splunk logs, nor the dead page served to you give you any indication that this is the situation and either could and BOTH SHOULD. Even when we turned on debug with /opt/splunk/bin/splunk start --debug, we STILL do not get any log telling us that this setting has explicitly disabled this core function. The ONLY place that you see this, and the only reason that we figured it out, is that it IS logged to stdout when you start splunk. You will see this somewhat casual note:

$ /opt/splunk/bin/splunk start

Splunk> All batbelt. No tights.

Checking prerequisites...
        Management port has been set disabled; the web UI cannot work.
        Checking http port [8000]: open
        Management port has been set disabled; cli support for this configuration is currently incomplete.

I opened a P4/ER to have this logged as a WARN but who knows if this will ever get implemented. Hopefully this answer will save somebody the day that I wasted on this. To be fair, it was my own fault; I was hardening UFs and did not have my blacklist correct for my server class so it hit a few of my Search Heads. DOH!

neerajshah81
Path Finder

Not sure what you are trying to say. Please provide accurate details. UF installation and http://localhost:8000 not coming up, have nothing to do with each other as both are on separate machines.

After whatever you do as @skoelpin mentioned When u confirm http://localhost:8000 is UP locally" and then when u need to access the URL from other systems u may need to configure your Linux Firewall settings on Splunk Server to allow connection to Port 8000.

0 Karma

ahmemohs03
Explorer

Hi Neeraj,

Q>Not sure what you are trying to say. Please provide accurate details. UF installation and http://localhost:8000 not coming up, have nothing to do with each other as both are on separate machines.
A> After UF installed on Linux B, Splunk weburl not comingup @ Linux A(index server) http://localhost:8000, this url was up before installing UF on lINUX B.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

What do the logs say? Have you triedhttps://localhost:8000 ?

Did you change the port during installation?

0 Karma

ahmemohs03
Explorer

Tried https://localhost:8000 but weburl is not coming up.

Did you change the port during installation?
No

0 Karma

pradeepkumarg
Influencer

There is no web interface for universalforwarder.

0 Karma

ahmemohs03
Explorer

Can i have your number please, i am in US, want to discuss on this issue.

Thanks,

0 Karma

ahmemohs03
Explorer

Yes, There is no web interface for universalforwarder.
I am checking on index server where splunk enterprises installed (http://hostname:8000)

0 Karma

pradeepkumarg
Influencer

I think I misinterpreted your questions. What happens when you run ./splunk status? Did you try restarting splunk ?

0 Karma

ahmemohs03
Explorer

Can i have your contact number?

0 Karma

ahmemohs03
Explorer

After running .splunk status its show

splunkd is running (PID: 16411).
splunk helpers are running (PIDs: 16420 16411).

0 Karma

adonio
Ultra Champion
0 Karma

adonio
Ultra Champion

embracing, see comment below, did not read the question 100%
the UF has no web interface

0 Karma

ahmemohs03
Explorer

Hi Adonio,

Yes, UF has no web interface, i am saying about Index server were i installed splunk enterprise.

Thanks

0 Karma

ahmemohs03
Explorer

I did try http://localhost:8000, but it not coming up, before UF installation it was up.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...