Getting Data In

The CLI on the Universal Forwarder does not work when the management port is disabled

chris
Motivator

A universal forwarder asks me to start splunk when i try to use the cli. Has anyone else experienced this or similar behaviour?

-bash-3.00$ pwd
/opt/splunkforwarder
-bash-3.00$ bin/splunk status
splunkd is running (PID: 21821).
splunk helpers are running (PIDs: 21822).
-bash-3.00$ bin/splunk list monitor
Splunk is not running, and it must be for this operation. To start splunk, run "splunk start".
-bash-3.00$ /opt/splunkforwarder/bin/splunk
couldn't run "/opt/splunkforwarder/bin/python": No such file or directory
-bash-3.00$ bin/splunk start
The splunk daemon (splunkd) is already running.
-bash-3.00$
1 Solution

chris
Motivator

Ok, this is kind of embarrassing but maybe someone will run into the same issue.

We disabled the management port on our forwarders for security reasons a while ago in the server.conf file, that was the problem. Comenting out the following lines helped:

[httpServer]
disableDefaultPort = true

View solution in original post

andyspusm
Explorer

Here's another one, in the hopes that it will help someone.

In our etc/system/local/server.conf, we had:

[sslConfig]
requireClientCert = true

This was causing the following errors:

02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - SSL Error for fd from HOST:localhost, IP:127.0.0.1, PORT:34566

Changing "requireClientCert" to "false" did the trick.

chris
Motivator

Ok, this is kind of embarrassing but maybe someone will run into the same issue.

We disabled the management port on our forwarders for security reasons a while ago in the server.conf file, that was the problem. Comenting out the following lines helped:

[httpServer]
disableDefaultPort = true
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...