Deployment Architecture

At startup, Splunk is "Waiting for web server..." Will it time out and allow my server to boot?

esalesapns2
Communicator

I broke web.conf and rebooted my linux box.
Booted in AWS on splunk_marketplace_AMI_2018-09-28_14_12_30.
SSHD hasn't started yet (it's S55sshd, splunk is S50splunk in /etc/rc.d/rc3.d/)
so I can't log into the box to fix it. Now what?

Tags (3)
0 Karma
1 Solution

esalesapns2
Communicator

As of 7.3.2, Splunk uses systemd on RHEL 7 and sets the splunk startup in /etc/rc.d/rc3.d to S90splunk, avoiding this issue.

View solution in original post

0 Karma

esalesapns2
Communicator

As of 7.3.2, Splunk uses systemd on RHEL 7 and sets the splunk startup in /etc/rc.d/rc3.d to S90splunk, avoiding this issue.

0 Karma

esalesapns2
Communicator

So I never got a reply. What I figured out is that it won't timeout. It turned my instance into an unusable brick. I had to create it again from scratch to fix a simple configuration issue. After I did, I made Splunk start after sshd by renaming the Splunk startup script to S60splunk in /etc/rc.d/rc3.d on this instance and all of my other instances. That allows sshd to start so you can login to fix any Splunk configuration issues.

If you're listening, Splunk, this would be a great change to make to your installer.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...