Installation

Blank Login Page

HMRCSplunk
Explorer

Hi,

So I have just installed splunk for the first time on my linux ubuntu machine. The only changes I have made during configuration is I have changed the HTTPS port in the web.conf file so that it uses port 12300 instead of 8000 port 8000 is being used by another program). I start splunk like usual and the output says that the ports are open and available to use and then links me the page of the splunk interface. When I click on the link it opens in my firefox browser and directs to the splunk web interface log in page. However nothing is displayed on the page.

I know that the web page is working correctly apart from its blank. The URL file structure changes to the log in page directory and I can also view the page source which is populated with what should be shown on the web page. I have also ran through the log files and there are no errors there either. Everything I have looked at looks like it should be running smoothly but it isnt. I have tried solutions on the internet like stopping iptables from running at the same time but I dont have iptables setup so this is not an cause.

If anyone has had and fixed this problem then please could you enlighten me as I feel like I have hit a brick wall with trying to install this.

Cheers

Tags (1)

ajh11g
Explorer

Just commenting to say that I'm also experiencing this problem.

I upgraded a 32-bit 6.3.8 install to the latest 7.0.1 32-bit install - blank login screen after the upgrade completed. I've followed some of the recommendations in this thread, but no luck there.

0 Karma

nickhills
Ultra Champion

I'm starting another answer because the last one got a bit long winded.

Splunk needs two processes to be running
- a python process which is the web server(normaly running on port 8000)
- the splunkd process (normally on 8089)

The web server will not run correctly without the splunkd process, and I think we established that if you ran ps -ef|grep splunkd you should (but do not) see a line which reads something like

 "/opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore"

Is that still the case?

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

Hi again,

I have ran the above command and get the following return.

/opt/splunk/bin/splunkd instrument-resource-usage -p 12389

0 Karma

nickhills
Ultra Champion

Ah! ok.
Who are those processes running as, and who owns all the files in /opt/splunk/*

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

Process is running as root and the only way I can access the /opt/splunk file is via root.

0 Karma

nickhills
Ultra Champion

Its generally considered a good idea not to run splunk as root.

To fix this - stop splunk.
(as root/sudo) chown splunk:splunk -R /opt/splunk
sudo su - splunk (change to splunk user)
/opt/bin/splunk start

Lets just rule out that making any difference.
Keep an eye on the output as splunk starts and make sure all the processes come up on the correct ports.

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

Ok I have done as you have said and I am now running splunk as the splunk user. All outputs from starting splunk all look good, 'all preliminary checks passed.' . The login page is still not visible but is still loading.

0 Karma

mplaksin
Engager

To change the port you have to use the command "splunk set web-port 9000" (this is an example with 9000 port)
Please check http://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Changedefaultvalues

0 Karma

HMRCSplunk
Explorer

Yes I have done this many a time now and isn't an issue to do with the port as the site is in fact loading all the files just not viewing them.

0 Karma

nickhills
Ultra Champion

You need to also change the splunkd process to use your revised management port.

You can do this via the web ui (which is clearly a non-starter for you) or via the command line.
Use: splunk set splunkd-port 12389 and restart Splunk and try again.

When you set the mgt port in web.conf you are telling the webserver which port splunkd is running on (rather than changing splunkd to use that port) - You have to take this additional step to actually run splunkd on the desired port.

Alternatively, you could change web.conf back to 8089 if this is not also a clash on your system.

http://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Changedefaultvalues#Use_Splunk_CLI

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

Thanks for the reply.

I have ran the command 'splunk set splunkd-port 12389' and restarted and that still doesn't fix the issue.

I have also separately tried changing the web.conf back to 8089 and that also doesn't fix it.

Cheers

0 Karma

nickhills
Ultra Champion

Are you on windows or Linux?

To run the above command you need to specify the path to the Splunk executable.

From a terminal you can cd to the correct location which will be something like (forgive me, I’m a Linux guy)
cd c:\program files\splunk\bin

/opt/splunk/bin on linux

Then you can run the above.
(Prepend the command with./ on a Linux system, eg ./splunk [command])

While your there also run
splunk restart

After it starts up, take a look at the output, about ports and post back here.

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

Hi, not sure why but your messages are loading in my emails but not visible on here. I have seen your reply of the spelling error, my bad. However I have removed the x from appserverport and restarted.

The output of a restart shows no errors anymore, but the webpage still shows a blank screen on both localhost:12300, 127.0.0.1:12300 and pcname:12300

0 Karma

nickhills
Ultra Champion

right, so you dont see a line which says 127.0.0.1:12389 ?

Can you take a look in /opt/splunk/var/log/splunk/splunkd.log and post the last 50 or so lines?

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

Nope there is no line which say 127.0.0.1:12389. There is a line that says 127.0.0.1:8066.

Checking appserver port [127.0.0.1:8066]: open

0 Karma

nickhills
Ultra Champion

Ok, whats in the splunkd.log file?

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

I have sent a copy of the log files but have not sent. From my understanding there is nothing in there that shows an error.

One thing I have found is "Style sheet could not be loaded. http://127.0.0.1:12300/en-GB/static/@7F44362F43575C23315E176660629FD2339C79AAD3986A3FD44E81AF17527B0...

0 Karma

nickhills
Ultra Champion

Do you have any dmp files in /opt/splunk/var/log/splunk?

The fact that you don't see any netstat entries for the splunkd service (the one running on 12389) it very much sounds like splunkd is starting and then stopping.

Since you say there is little evidence in the splunkd.log file, if you have any dmp files, it would suggest that splunkd is hard crashing.

If my comment helps, please give it a thumbs up!
0 Karma

HMRCSplunk
Explorer

Sorry, whenever I try and send the log files, it comes up that the moderators are checking the text before it is published to everyone else.

There are no .dmp files in the log directory.

I believe it may have something to do with javascript as the only errors that are appearing are in the browser and cant collect bootstrap-enterprise.js or account.js as they cant be located.

0 Karma

nickhills
Ultra Champion

what about anything interesting in web_access.log web_service.log crash*.log?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...