How come Splunkd is crashing whenever I try to install an app using the Splunk user interface?

[shayhibah]

Hi,

I would like to browse for apps and install app from the Splunk user interface.

For some reason, I get the following error on each app I tried to install:

https://pasteboard.co/HN9gNd6.jpg

I check the status of splunkd on my Splunk server and its down.

Can someone help me to solve this issue?

Thanks

[DavidHourani]

Are you getting this for all applications or some ?

[shayhibah]

for all applications

[DavidHourani]

After Splunk is disabled and you start it back up, is the app installed ? Or are you getting nothing at all ?

[shayhibah]

getting nothing all

[DavidHourani]

can you see anything in your _internal logs ? ERROR or WARN logs ?

[darrenfuller]

Short answer:
When you install an app through the UI and the system fails to start again, you need to have the process manually (re)started on your server.

Longer answer:

[Single Search Head]
If this is a single instance or a single search head connecting to one or more Indexers / Index clusters, then someone needs to log into the host and start the Splunk process.

If the host still fails to start, review $SPLUNK_HOME/var/log/splunk/splunkd.log on startup to see what the system is complaining about. To start over, you can delete the app directory from $SPLUNK_HOME/etc/apps/[APPNAME] and restart splunk to start again.

[Search Head Cluster]
If this is a Search Head Cluster, then you can't do what you are trying to do. You cannot install apps through the "Browse for more apps" in the UI. The correct method for deploying apps to a Search Head Cluster is to put the app into $SPLUNK_HOME/etc/shcluster/apps on your Deployer node and then push the app to the search head cluster members

Good luck!

[shayhibah]

the process stop running as soon as I install apps.
I still do not understand why it stopped every time I install apps - this should not happen at all.
I don't think I need to restart it manually.