So I have just installed splunk for the first time on my linux ubuntu machine. The only changes I have made during configuration is I have changed the HTTPS port in the web.conf file so that it uses port 12300 instead of 8000 port 8000 is being used by another program). I start splunk like usual and the output says that the ports are open and available to use and then links me the page of the splunk interface. When I click on the link it opens in my firefox browser and directs to the splunk web interface log in page. However nothing is displayed on the page.
I know that the web page is working correctly apart from its blank. The URL file structure changes to the log in page directory and I can also view the page source which is populated with what should be shown on the web page. I have also ran through the log files and there are no errors there either. Everything I have looked at looks like it should be running smoothly but it isnt. I have tried solutions on the internet like stopping iptables from running at the same time but I dont have iptables setup so this is not an cause.
If anyone has had and fixed this problem then please could you enlighten me as I feel like I have hit a brick wall with trying to install this.
Just commenting to say that I'm also experiencing this problem.
I upgraded a 32-bit 6.3.8 install to the latest 7.0.1 32-bit install - blank login screen after the upgrade completed. I've followed some of the recommendations in this thread, but no luck there.
I'm starting another answer because the last one got a bit long winded.
Splunk needs two processes to be running
- a python process which is the web server(normaly running on port 8000)
- the splunkd process (normally on 8089)
The web server will not run correctly without the splunkd process, and I think we established that if you ran
ps -ef|grep splunkd you should (but do not) see a line which reads something like
"/opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore"
Is that still the case?
Its generally considered a good idea not to run splunk as root.
To fix this - stop splunk.
chown splunk:splunk -R /opt/splunk
sudo su - splunk (change to splunk user)
Lets just rule out that making any difference.
Keep an eye on the output as splunk starts and make sure all the processes come up on the correct ports.
Ok I have done as you have said and I am now running splunk as the splunk user. All outputs from starting splunk all look good, 'all preliminary checks passed.' . The login page is still not visible but is still loading.
You need to also change the splunkd process to use your revised management port.
You can do this via the web ui (which is clearly a non-starter for you) or via the command line.
splunk set splunkd-port 12389 and restart Splunk and try again.
When you set the mgt port in web.conf you are telling the webserver which port splunkd is running on (rather than changing splunkd to use that port) - You have to take this additional step to actually run splunkd on the desired port.
Alternatively, you could change web.conf back to 8089 if this is not also a clash on your system.
Thanks for the reply.
I have ran the command 'splunk set splunkd-port 12389' and restarted and that still doesn't fix the issue.
I have also separately tried changing the web.conf back to 8089 and that also doesn't fix it.
Are you on windows or Linux?
To run the above command you need to specify the path to the Splunk executable.
From a terminal you can cd to the correct location which will be something like (forgive me, I’m a Linux guy)
cd c:\program files\splunk\bin
/opt/splunk/bin on linux
Then you can run the above.
(Prepend the command with
./ on a Linux system, eg
While your there also run
After it starts up, take a look at the output, about ports and post back here.
Hi, not sure why but your messages are loading in my emails but not visible on here. I have seen your reply of the spelling error, my bad. However I have removed the x from appserverport and restarted.
The output of a restart shows no errors anymore, but the webpage still shows a blank screen on both localhost:12300, 127.0.0.1:12300 and pcname:12300
right, so you dont see a line which says
Can you take a look in /opt/splunk/var/log/splunk/splunkd.log and post the last 50 or so lines?
I have sent a copy of the log files but have not sent. From my understanding there is nothing in there that shows an error.
One thing I have found is "Style sheet could not be loaded. http://127.0.0.1:12300/en-GB/static/@7F44362F43575C23315E176660629FD2339C79AAD3986A3FD44E81AF17527B0...
Do you have any dmp files in /opt/splunk/var/log/splunk?
The fact that you don't see any netstat entries for the splunkd service (the one running on 12389) it very much sounds like splunkd is starting and then stopping.
Since you say there is little evidence in the splunkd.log file, if you have any dmp files, it would suggest that splunkd is hard crashing.
Sorry, whenever I try and send the log files, it comes up that the moderators are checking the text before it is published to everyone else.
There are no .dmp files in the log directory.