- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Web_service.log is empty after upgrading from Splu...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Web_service.log is empty after upgrading from Splunk version 7.3 to 8.0.
I have just upgraded my Splunk deployment server from 7.3 to 8.0 and after upgrading the web UI will not come up. I was trying to troubleshoot and was looking at the web_service.log but for some reason it is empty (0 bytes). I cannot figure out why it is not getting any logs or why the UI drops after the upgrade. Any suggestions would be greatly appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Error messages in Splunkd can help. Also, please check if the certificate that you've specified in web.conf is still valid or not, and the correct path to the certificate is mentioned over there.
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the only thing in ./local/web.conf is
[settings]
startwebserver = 1
~
this is a test DS that I am trying to upgrade before hitting prod.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @dolj
check splunkd.log for any WARNs or ERRORs directly after the restart
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
checked the splunkd.log while restarting and there were no WARN or ERROR messages only INFO. When you tail the splunkd.log there are not entries written while starting, stopping, or restarting.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@dolj
no log entries at all during restart - that's unusual. Does splunk process running?
ps aux | grep -i splunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not sure why but it wasn't working and it now is.
I found this log related to the web UI
05-24-2020 23:12:06.172 -0400 ERROR UiHttpListener - An applicaiton server has exited unexpectedly, web UI cannot be used until it is restarted
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
