Upgraded from Splunk 7.0.3 to 7.2.1 and the Splunk Web Server is unavailable.

[christopherr_sp]

Upgraded from Splunk 7.0.3 and 7.2.1 the Splunk Web Server is unavailable.

When Splunk is started from the command line, the following output appears on the screen:

Waiting for web server at http://127.0.0.1:8000 to be available...........................
..........................................................................................

WARNING:  web interface does not seem to be available!

[christopherr_sp · Accepted solution]

The workaround is to disable health reporting in health.conf (until the Bug is fixed in Splunk 7.2.x).

The issue is a known and is caused by the Bugs below.

SPL-162549
splunkweb fails to start and SHC member shows as down
Affects: 7.1.4
Fixed in: 7.1.6

SPL-160230
Splunkd web fails to start due to deadlock among Health Reporter threads
Affects: 7.1.2
Fixed in: 7.1.6

Steps

1. Make the changes to the file below:

/etc/system/local/health.conf

[clustering]
disabled = 1

[feature:batchreader]
disabled = 1

[feature:tailreader]
disabled = 1

[feature:s2s_autolb]
disabled = 1

[feature:indexers]
disabled = 1

[feature:data_durability]
disabled = 1

[feature:cluster_bundles]
disabled = 1

[feature:indexing_ready]
disabled = 1

[feature:data_searchable]
disabled = 1

[feature:searchheadconnectivity]
disabled = 1

[feature:replication_failures]
disabled = 1

[feature:master_connectivity]
disabled = 1

[feature:slave_state]
disabled = 1

[feature:slave_version]
disabled = 1

2.Restart Splunk.