Splunk on RHEL9 won't start

[atr]

I have installed Splunk Enterprise on an RHEL9 VM in AWS. I have tried installing via TAR and RPM. I also tried starting it as "root" and "splunk" users but it just won't start. It always hangs at the same point and when that happens I can't even SSH to my VM. I have to reboot the VM to get access to it again.

It stays here for about 30 minutes (maybe longer).

atr_2-1721688360491.png

Then, I see the following.

atr_1-1721688197127.png

Any idea what might be going on?

[atr · Accepted solution]

I was able to get it running. The culprit was RAM. I increased it significantly and it is starting up now.

[gcusello]

Hi @atr ,

check also the other hardware reuirement, to avoid next issues.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[atr]

Thanks for your responses! I do not have a local firewall and SELinux is disabled. I do see "Socket error communicating with splunkd" messages in a couple of logs. I am not sure how to interpret that. Also, there is nothing of relevance in "/opt/splunk/var/log/splunk/first_install.log"

[gcusello]

Hi @atr ,

as @deepakc said, check and disable the local firewall.

Then see at /opt/splunk/var/log/splunk/first_install.log if something is described.

If you continue to have issues, open a case to Splunk Support, But I'm confident that the issue is the local firewall.

Ciao.

Giuseppe

[deepakc]

 Start by checking that you have port 8000 available - check firewall ports 

The SSH issue is again most likely related to ports/access 22 (but this is not a splunk issue)

Speak to an Linux OS admin, as your issue's seem to be OS config related.