Update to 8.0 - Web interface does not seem to be available

[tbaublys_splunk]

After update to 8.0 splunkd is starting but ""WARNING: web interface does not seem to be available" appears.
Following error in /opt/splunk/var/log/splunk/web_service.log:
Unable to start splunkweb
Some lines above:
File "/opt/splunk/etc/apps/search_activity/appserver/modules/VMwareTreeNav/VMwareTreeNav.py", line 5, in
import UserDict
ModuleNotFoundError: No module named 'UserDict'

[woodcock]

This also happens with splunk_app_for_nix; it gives this error:

File "/opt/splunk/etc/apps/splunk_app_for_nix/appserver/modules/UnixSpiderGraph/UnixSpiderGraph.py", line 5, in <module> from sets import Set
ModuleNotFoundError: No module named 'sets'

[David · Accepted solution]

A new release of the Search Activity app has been released (2.2.13) that pulls the view that was breaking Splunk 8.

The VMware Tree View viz that I copied in the app for the organizational hierarchy dashboard relies on CherryPy controllers which aren’t compatible with Python 3, and it prevents SplunkWeb from loading. Version 2.2.13 removes that view from the app. I am also restarting work on a new version of the app for the modern era (though that particular view, as much as I love it, probably won't make the cut due to the big effort that would be required to port it to the modern era).

If you're running 2.2.12, grab 2.2.13 as soon as you can. https://splunkbase.splunk.com/app/2632/

[tbaublys_splunk]

Thank you very much, this resolves the issue!

[cburke_splunk]

Hi @tbaublys_splunk,

So, there are two things happening here:

1. We removed 99% of the underlying AdvancedXML modules in Splunk 8.0. This means trying to make a custom module that inherits from one that no longer exists is going to fail. It sounds like search_activity still uses AdvancedXML, so in order for that app to work with 8.0 it would have to be ported.
2. When you have a python import exception in the appserver/splunkweb layer, CherryPy, the appserver/splunkweb, will not start. So, because 1 is failing on import, it breaks splunkweb.

I would highly recommend you run the Readiness App (https://splunkbase.splunk.com/app/4698/) on your system. It should have caught all of these upgrade blockers before you upgraded to 8.0.

I hope this helps!

Cory

[tbaublys_splunk]

Thank you @cburke, I was not aware of the Readiness App - https://splunkbase.splunk.com/app/4698/

[tbaublys_splunk]

I had to remove the search_activity app! https://splunkbase.splunk.com/app/2632/ - after moving the search_activity directory splunk web started.