Monitoring Splunk

splunkd is running but 8000 is disabled

qubick
Path Finder

I usually used a web application to control or edit settings for data forwarder. Yesterday, the web access to the localhost:8000 is disabled showing page not found. I checked netstat -an | grep 8000, my terminal showed nothing, so checked again netstat -anltp | grep "LISTEN", and it only shows 8099 opened for plunk deamon, which seems to be a mgmt server, not web interface server.

What should I do to enable web interface again? tried to restart, but still not listening 8000

0 Karma
1 Solution

jgedeon120
Contributor

$SPLUNK_HOME/bin/splunk enable webserver then restart splunk, if this is a splunk universal forwarder then there is no web interface.

View solution in original post

jgedeon120
Contributor

$SPLUNK_HOME/bin/splunk enable webserver then restart splunk, if this is a splunk universal forwarder then there is no web interface.

jgedeon120
Contributor

It can be any Splunk Enterprise install but not a Splunk Universal forwarder.

0 Karma

qubick
Path Finder

This command said me this is not permitted on this installation. I removed all splunk related folder and reinstall just a "splunk" instance. I believe this can also be a forwarder if I configure data forwarding. Thanks,

0 Karma

qubick
Path Finder

No, spunk is not found when I check via 'ps'. I found web.conf containing this stanza, so chained the value to 1 (true), restarted again. But still not working with web interface… One more question, do you think it will be working if i remove all spunk related folder, reinstall splunkforwarder? Thanks in advance!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Check if the splunkweb process is running, and if it is not check if any web.conf contains startwebserver=0

qubick
Path Finder

I always start using terminal because it is installed on the Ubuntu. It just restart successfully, showing 'done' message, but no 8000 port used - only mgmt port is.

0 Karma

lukejadamec
Super Champion

Open a command prompt on the machine as administrator and start splunkd. It will tell you if there are issues with the ports.
c:\program files\splunk\bin\splunk.exe restart

0 Karma

qubick
Path Finder

Nope, its just splunkforwarder. even a spunk instance doesn't work with the 8000 port

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is that a Splunk Universal Forwarder? The UF does not come with a web interface.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...