Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: 503 Service unavailable - Is my splunkd crashe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could not able to access Splunkweb.
ERROR : 503 Service unavailable
The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running.
Splunkd , Splunkweb - Services are running fine. VERIFIED
How can i troubleshoot this issue ?
Please help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There sure seems to be a problem. Usually get that when splunk is restarting and therefore is not ready to handle my web requests.
Run in the shell:
splunk status
Should say something like:
splunkd is running (PID: 16691).
splunk helpers are running (PIDs: 16692).
splunkweb is running (PID: 16991).
Have a look at /opt/splunk/var/log/splunk/splunkd.log.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The issue will raise at the time of splunk restart or else in some times due to network outage. Try logging into splunkweb for particular server. If you can able to login ten everything is working properly. Even you can check by loggin into indexers. ( cluster master to check the splunk is up or not)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Instance of splunk is running already and it enters into a CLOSE_WAIT state.
So , we need to kill the previously existing Splunk instance in the TASK MANAGER.
Its working now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There sure seems to be a problem. Usually get that when splunk is restarting and therefore is not ready to handle my web requests.
Run in the shell:
splunk status
Should say something like:
splunkd is running (PID: 16691).
splunk helpers are running (PIDs: 16692).
splunkweb is running (PID: 16991).
Have a look at /opt/splunk/var/log/splunk/splunkd.log.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2021 04:00:35.158 +0100 WARN ProcessTracker - executable=splunk-optimize failed to start reason='': Média protégé en écriture.
i have the same probleme in splunk on WINDOWS 10, when i had a look in splunk/var/log/splunk/splunkd.log he told splunk failed to start ( 03-29-2021 04:00:35.158 +0100 WARN ProcessTracker - executable=splunk-optimize failed to start reason='': Média protégé en écriture. )
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My first suggestion is to check splunk logs at $SPLUNK_HOME/var/log. Do they suggest anything?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The issue will raise at the time of splunk restart or else in some times due to network outage. Try logging into splunkweb for particular server. If you can able to login ten everything is working properly. Even you can check by loggin into indexers. ( cluster master to check the splunk is up or not)
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
