Startwebserver 0

[Laurence]

When I start Splunk after a reboot of the server splunk is running fine but the webserver is not starting.

./splunk cmd btool web list --debug |grep startwebserver
/opt/splunk/etc/apps/SplunkLightForwarder/default/web.conf startwebserver = 0

Is there a way to manualy start the webserver? I run Ubuntu

Thanks,
Laurence

[badrinath_itrs]

The Webserver gets restarted automatically if that is enabled as startwebserver =1 in web.conf.

Can you check if you have a file in $SPLUNK_HOME/etc/system/local/web.conf that disable the webserver ? if not create a file and enable the settings ? 

[Laurence]

The file web.conf isn't there. Also I dont realy know what to put in the file when I create it.

[Laurence]

I got it fixed, found the settings for the file in the splunk documentation. Thank you for you help.

[isoutamo]

BTW, if this is a peer in indexer cluster or heavy forwarder then it's best practice to keep web GUI down for security reasons.
https://docs.splunk.com/Documentation/Splunk/8.2.3/Security/WhatyoucansecurewithSplunk

[badrinath_itrs · Accepted solution]

If this enterprise SPLUNK installation , it should be enabled in web.conf in $SPLUNK_HOME/etc/system/default.

You can try adding below settings in $SPLUNK_HOME/etc/system/local/web.conf

[settings]
startwebserver = 1