Deployment Architecture

Why is splunkweb not starting on an indexer cluster member with hanging message "Waiting for web server at...to be available..."?

pdjhh
Communicator

Hi,

Sorry this could be a bit of a newb question, but I've spent a good few hours on this one and haven't managed to work it out. I've got some linux VMs that are all accessible through port translations in my VM configuration for ssh and splunk web. What I'm trying to do is create an indexer cluster with 3 indexing peers, a cluster master and a search head so I've been following the instructions in the splunk docs.

So I configure the master, then move on to the slaves. What happened was, as soon as I restarted splunk on those slaves, they would come back up but with no splunk web. I just end up with this forever:

Waiting for web server at http://127.0.0.1:8000 to be available...................................

As soon as I change it back to being standalone (not an index slave and no peering), then restart, it comes straight up no problem. Thought I might have configured it incorrectly, but I've done it through the gui, the cli and editing the server.conf file and get the same each time. Thought a port conflict, but couldn't see one. Tried changing them anyway and no luck. Doesn't seem to be permissions either as starting as root has same outcome.

I did see one article here that suggested that you can't run splunkweb on a cluster member, but the docs seems to say you should be able to jump straight back onto it once it comes back up from restart. Looking for some advice on this before spending any more time on it. Nothing at all in the linux or splunk logs.

Thanks.

woodcock
Esteemed Legend

You have not told us how you "change it back to being standalone" or how you did the opposite. How can we possibly help without this information? Are you using GUI or CLI? What are the settings that you are changing?

0 Karma

Lorenzo1
Path Finder

am having same problem running splunk WEB on my second and third indexers as i wanted to go and configure their listening ports however, the first indexer is connecting to the web without any problems. I didn't experience this yesterday

 

0 Karma

AlokAgarwal69
New Member

Hi pdjhh - I am facing the same issue. How was your issue resolved ? Would be grateful for inputs.

0 Karma

vijay_n
Engager

hi, did you get the solution to this problem?

0 Karma

Ovi
Path Finder

I've seen this behaviour when configuring multi-site clustering but it's just a temporary thing when you start adding nodes to the cluster.
First, second nodes will do this
You just need to configure enough node peers for your clustering replication factor ( like min 4. 2 per site)
Once that's done they will function properly and all stop/starts are fast again Web interface included
Of course the very next step is to push the config from the Node Master to disbale the Web interface on all nodes 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...