Webconsole for indexers not accesible

[hrithiktej]

We have two indexers and i want to enable webconsole for them and I enabled webserver console using the command ./splunk enable webserver and restarted splunk services using ./splunk restart splunkd but nothing seems to listen on 8000,

port query to server on 8000 shows not listening

systemctl status firewalld shows firewall is inactive

telnet 127.0.0.1 8000 shows connection refused.

netstat -an | grep 8000 no results displayed.

./splunk show web-port shows results as 8000

what am i missing it should atleast listen on 8000 on other servers where i have splunk webconsole accesible like our license server, search head , enterprise security head netstat -an | grep 8000 shows me listening on 8000

[hrithiktej · Accepted solution]

Thanks

I got this resolved by working with splunk support, using the debug command ./splunk cmd btool web list --debug | grep startwebserver we found there was a different web.conf file from a installed app (named ascr_all_indexer_base) that was taking priority over the default web.conf and hence this was failing. After I edited the web.conf in the location /opt/splunk/etc/slav-apps/ascr_all_indexer_base/local/ changed value from 0 to 1 and restarted splunk services now it is working.

This is a nice command to find out the issue ( ./splunk cmd btool web list --debug | grep startwebserver)

-bash-4.2$ ./splunk cmd btool web list --debug | grep startwebserver
/opt/splunk/etc/slav-apps/ascr_all_indexer_base/local/web.conf startwebserver = 0
-bash-4.2$ cd /opt/splunk/etc/slav-apps/ascr_all_indexer_base/local/
-bash-4.2$ cat web.conf
startwebserver = 0

[aaraneta_splunk]

@hrithiktej - Glad you were able to work with Splunk Support to find the solution to your issue. I've converted your comment to an answer so please click "Accept" below to resolve your question, and so others can easily find this question should they run into the same issue. Thanks!

[woodcock]

Also disable selinux. It will drive you NUTS!