splunkd is running but 8000 is disabled

[qubick]

I usually used a web application to control or edit settings for data forwarder. Yesterday, the web access to the localhost:8000 is disabled showing page not found. I checked netstat -an | grep 8000, my terminal showed nothing, so checked again netstat -anltp | grep "LISTEN", and it only shows 8099 opened for plunk deamon, which seems to be a mgmt server, not web interface server.

What should I do to enable web interface again? tried to restart, but still not listening 8000

[jgedeon120 · Accepted solution]

$SPLUNK_HOME/bin/splunk enable webserver then restart splunk, if this is a splunk universal forwarder then there is no web interface.

[jgedeon120]

It can be any Splunk Enterprise install but not a Splunk Universal forwarder.

[qubick]

This command said me this is not permitted on this installation. I removed all splunk related folder and reinstall just a "splunk" instance. I believe this can also be a forwarder if I configure data forwarding. Thanks,

[qubick]

No, spunk is not found when I check via 'ps'. I found web.conf containing this stanza, so chained the value to 1 (true), restarted again. But still not working with web interface… One more question, do you think it will be working if i remove all spunk related folder, reinstall splunkforwarder? Thanks in advance!

[martin_mueller]

Check if the splunkweb process is running, and if it is not check if any web.conf contains startwebserver=0

[qubick]

I always start using terminal because it is installed on the Ubuntu. It just restart successfully, showing 'done' message, but no 8000 port used - only mgmt port is.

[lukejadamec]

Open a command prompt on the machine as administrator and start splunkd. It will tell you if there are issues with the ports.
c:\program files\splunk\bin\splunk.exe restart

[qubick]

Nope, its just splunkforwarder. even a spunk instance doesn't work with the 8000 port

[martin_mueller]

Is that a Splunk Universal Forwarder? The UF does not come with a web interface.