Archive
Highlighted

can't access web

New Member
Starting splunk server daemon (splunkd)...  
Done
                                                       [  OK  ]

Waiting for web server at http://127.0.0.1:8000 to be available... Done


If you get stuck, we're here to help.  
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://splunk:8000

however when i access http://splunk:8000 got an empty page, nothing come up. I tried the IP:8000 the same.
when i check the log, noticed the following

Failed to initialize http_proxy from server.conf for splunkd. Please make sure that the http_proxy property is set as 
http_proxy=http://host:port in case HTTP proxying needs to be enabled.

When I check the listne port to 8000, got nothing:
root@splunk ~]$ sudo ss -l | grep 8000
u_str LISTEN 0 100 private/verify 18000

what should I do now?
why it didnt listen to 8000?
I can ping the ip address but it seems the web app not accessible.

Thanks in advanced!

Winnie

Tags (1)
0 Karma
Highlighted

Re: can't access web

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: can't access web

New Member

no, i dont need to, just wonder why i can't access web app at 8000, nothing there? seems not running. how to make it works?

0 Karma
Highlighted

Re: can't access web

SplunkTrust
SplunkTrust

try localhost:8000
also try to navigate to $SPLUNK_HOME/etc/system/default/web.conf and look for:
httpport = 8000
verify this is the port
is this a windows or linux install?

0 Karma
Highlighted

Re: can't access web

New Member

It's cents on vbox

0 Karma
Highlighted

Re: can't access web

New Member
port number tag is missing or 0 the server will NOT start an http listener
# this is the port used for both SSL and non-SSL (we only have 1 port now).
httpport = 8000

# this determines whether to start SplunkWeb in http or https.
enableSplunkWebSSL = false

# location of splunkd; don't include http[s]:// in this anymore.
mgmtHostPort = 127.0.0.1:8089

# list of ports to start python application servers on (although usually
# one port is enough)  Set to 0 to instead run the application server
# directly as the web front end on 'httpport', separate from splunkd.
appServerPorts = 8065

And this is the listening ports

tcp    LISTEN     0      128     *:ssh                   *:*                    
tcp    LISTEN     0      128     *:8089                  *:*                    
tcp    LISTEN     0      100    127.0.0.1:smtp                  *:*                    
tcp    LISTEN     0      128     *:8191                  *:*                    
tcp    LISTEN     0      128     *:irdmi                 *:*                    
tcp    LISTEN     0      100    127.0.0.1:8065                  *:*                    
tcp    LISTEN     0      128    :::ssh                  :::*                    
tcp    LISTEN     0      100       ::1:smtp                 :::*   
0 Karma
Highlighted

Re: can't access web

New Member

tcp LISTEN 0 128 :ssh *:

tcp LISTEN 0 128 :8089 *:

tcp LISTEN 0 100 127.0.0.1:smtp :

tcp LISTEN 0 128 :8191 *:

tcp LISTEN 0 128 :irdmi *:

tcp LISTEN 0 100 127.0.0.1:8065 :

tcp LISTEN 0 128 :::ssh :::*

tcp LISTEN 0 100 ::1:smtp :::*

port number tag is missing or 0 the server will NOT start an http listener

this is the port used for both SSL and non-SSL (we only have 1 port now).

httpport = 8000

this determines whether to start SplunkWeb in http or https.

enableSplunkWebSSL = false

location of splunkd; don't include http[s]:// in this anymore.

mgmtHostPort = 127.0.0.1:8089

list of ports to start python application servers on (although usually

one port is enough) Set to 0 to instead run the application server

directly as the web front end on 'httpport', separate from splunkd.

appServerPorts = 8065

I have tried both localhost and my ipaddress or splunk none of them working. what should be the exact url i need to access?
I have mapping my ip in to the etc/hosts file

0 Karma
Highlighted

Re: can't access web

SplunkTrust
SplunkTrust

It looks like it's definately NOT listening on port 8000, so that proxy setting (or something) is messing it up.

Try checking $SPLUNK_HOME/etc/system/local/server.conf for "http_proxy" and erase those lines, if any.

Restart Splunk, then you can run the same netstat tests to see if something is now listening on port 8000 (and check logs, etc...)

If nothing still is, try this:

$ splunk btool server list --debug | grep -i proxy

In my case - no proxy - it gives me this list:

/opt/splunk/etc/system/default/server.conf                             alert_proxying = true
/opt/splunk/etc/system/default/server.conf                             async_replicate_on_proxy = true
/opt/splunk/etc/system/default/server.conf                             ra_proxying = true
/opt/splunk/etc/system/default/server.conf                             sid_proxying = true
/opt/splunk/etc/system/default/server.conf                             ss_proxying = true

Double-check there's no "http_proxy" line, and if there is it'll tell you WHERE it is so you can go whack it.

0 Karma
Highlighted

Re: can't access web

New Member

I didn't touch any those .conf file, so they all default

[root@splunk ~]# splunk btool server list --debug | grep -i proxy
-bash: splunk: command not found
[root@splunk ~]# cd /opt/splunk
[root@splunk splunk]# splunk btool server list --debug | grep -i proxy
-bash: splunk: command not found
[root@splunk splunk]#

0 Karma
Highlighted

Re: can't access web

SplunkTrust
SplunkTrust

For Linux, you almost had it. 🙂

cd /opt/splunk/bin
./splunk btool server list --debug | grep -i proxy

I should have thought to include the default path in there.

0 Karma