Installation

Losing access to GUI & splunk not starting when index clustering is enabled on manager.

ThatGingerGuy98
Loves-to-Learn

Whenever I enable index clustering on what is to be my splunk manager, I go to restart it and it never comes back on.  Disabling index clustering through the cli returns access to the gui and allows splunk to start like normal.  Journalctl returns the following (after trying to start splunk with "systemctl start splunk")...
> splunk[9423]: Waiting for web server at https://127.0.0.1:8000 to be available.........

> splunk[9423]: WARNING: web interface does not seem to be available!

> systemd[1]: splunk.service: control process exited, code=exited status=1

> systemd[1]: Failed to start Splunk Enterprise

 

Trying to start splunk from the binary returns the following...

> Checking http port [8000]: not available

> ERROR: http port [8000] - no permision to use address/port combination.  Splunk needs to use this port.

 

I've reinstalled splunk and rebuilt the VM that splunk is sitting on and neither of these have worked.

Labels (1)
0 Karma

fredclown
Builder

When you enable indexer clustering on the cluster manager what does the /opt/splunk/etc/system/local/server.conf file look like (don't post it ... there is sensitive stuff there)? Is anything getting port 8000 assigned to it?

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...