Getting error message after upgrade to splunk-6.4.0-f2c83632 "WARNING: web interface does not seem to be available"

[krellinst]

After upgrading to Splunk 6.4.0, I cannot start the splunk service. Between the last 2 updates, the only thing that I have done is added our SSL wildcard cert which was working fine. Is there something in the upgrade process I am missing if we are doing SSL?

[andrewcg · Accepted solution]

I am having the same issue. This is not the proxy 500 error. None of those fixes will resolve this isuse, I tried them all. For me, I found that, something has changed around the requirements for the the SSL certificate format that is used for the non Splunk Web SSL. Revert to the default SSL settings in the server.conf file and your instance should start up correctly again. The SSL cert setting in your web.conf should be able to remain the same. My issue is here:

https://answers.splunk.com/answers/402988/after-upgrading-to-64-why-are-our-signed-certs-no.html

[krellinst]

My fix was to comment out everything in server.conf area under SSL Settings. For some reason it isn't required there and the web.conf still works and the certificate is available.

[ltawfall]

I had that error.. I think. Here's the response I got from splunk support.

The 500 error is a known problem when upgrading to version 6.4. I have documentation here that should fix your problem and make Splunk usable again. If you are still having problems after trying the suggested fix below please reply to this email so we can assist you further.

The workaround for this issue is to export in the environment NO_PROXY="127.0.0.1,localhost" prior to starting Splunk or adding it to $SPLUNK_HOME/etc/splunk-launch.conf and restarting Splunk.
If the proxy is set in splunk-launch.conf but not actually being used or needed, simply remove the setting and restart.

[krellinst]

That didn't help. Here is what I am seeing up boot. I can provide any other logs if they would be helpful.

Starting Splunk...

Splunk> See your world.  Maybe wish you hadn't.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking appserver port [127.0.0.1:8065]: open
        Checking kvstore port [8191]: open
        Checking configuration...  Done.
        Checking critical directories...        Done
        Checking indexes...
                Validated: _audit _internal _introspection _thefishbucket histor                                                                                                                                                             y main os summary
        Done
        Checking filesystem compatibility...  Done
        Checking conf files for problems...
                Improper stanza [dhcpd_server_dhcprelease] in /opt/splunk/etc/ap                                                                                                                                                             ps/unix/default/tags.conf, line 30
                Your indexes and inputs configurations are not internally consis                                                                                                                                                             tent. For more information, run 'splunk btool check --debug'
        Done
        Checking default conf files for edits...
        Validating installed files against hashes from '/opt/splunk/splunk-6.4.0                                                                                                                                                             -f2c836328108-linux-2.6-x86_64-manifest'
        All installed files intact.
        Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done


Waiting for web server at https://127.0.0.1:8000 to be available........

WARNING: web interface does not seem to be available!