Installation

splunk could start due to splunkweb time out help !!

HelpMePlease
Explorer

I used cmd to restart splunk but splunkweb time out. I only know how to restart using cmd as I saw some people say:

1 stop splunk
2 check the presence and owner/permissions on $SPLUNK_HOME/var/run/splunk/*.pid
3 delete them if they still exists
4 if needed do a chown -R for the splunk folders to change the owner
5 start splunk under the correct user
6 double check that the service starts with the correct user

How can I start ? How do I solve it. I don't know how to chown -R and start splunk under correct user. Anyone can teach me in detail way ? After using CCleaner, I could not even start localhost:8000. I only can use localhost:8000, whenever I use the web it direct me to a strange ip that splunk could not start.

But the main problem is how I can troubleshoot or debug to make my splunk work. I believe is CCleaner that cause the problem.

Tags (1)
0 Karma
1 Solution

HelpMePlease
Explorer

Solved by uninstall and installing Splunk again. Took risk to retain data in C:\Program Files\Splunk\var\lib\splunk\defaultdb\db then replace db in new Splunk. Luckily my data is still inside new Splunk. Cheers !

View solution in original post

0 Karma

HelpMePlease
Explorer

Solved by uninstall and installing Splunk again. Took risk to retain data in C:\Program Files\Splunk\var\lib\splunk\defaultdb\db then replace db in new Splunk. Luckily my data is still inside new Splunk. Cheers !

0 Karma

KarunK
Contributor

You can check the "/opt/splunk/var/log/splunk/splunkd.log" for more clues. In most cases it will be help full.

Hope this helps

0 Karma

HelpMePlease
Explorer

yes it is running before, I went to cmd to do a splunk restart, the splunkd is start while splunkweb timed out.

0 Karma

linu1988
Champion

Was it running before?
If you want to start the service

go to splunk_home/bin
splunk start/restart.

And you dont have to worry about the chown command. In windows it's flexible. Run it under administrator/if you have any other account to run under. Thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...