- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: splunkd is running but 8000 is disabled
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I usually used a web application to control or edit settings for data forwarder. Yesterday, the web access to the localhost:8000 is disabled showing page not found. I checked netstat -an | grep 8000, my terminal showed nothing, so checked again netstat -anltp | grep "LISTEN", and it only shows 8099 opened for plunk deamon, which seems to be a mgmt server, not web interface server.
What should I do to enable web interface again? tried to restart, but still not listening 8000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
$SPLUNK_HOME/bin/splunk enable webserver then restart splunk, if this is a splunk universal forwarder then there is no web interface.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
$SPLUNK_HOME/bin/splunk enable webserver then restart splunk, if this is a splunk universal forwarder then there is no web interface.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It can be any Splunk Enterprise install but not a Splunk Universal forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This command said me this is not permitted on this installation. I removed all splunk related folder and reinstall just a "splunk" instance. I believe this can also be a forwarder if I configure data forwarding. Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, spunk is not found when I check via 'ps'. I found web.conf containing this stanza, so chained the value to 1 (true), restarted again. But still not working with web interface… One more question, do you think it will be working if i remove all spunk related folder, reinstall splunkforwarder? Thanks in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check if the splunkweb process is running, and if it is not check if any web.conf contains startwebserver=0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I always start using terminal because it is installed on the Ubuntu. It just restart successfully, showing 'done' message, but no 8000 port used - only mgmt port is.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Open a command prompt on the machine as administrator and start splunkd. It will tell you if there are issues with the ports.
c:\program files\splunk\bin\splunk.exe restart
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nope, its just splunkforwarder. even a spunk instance doesn't work with the 8000 port
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is that a Splunk Universal Forwarder? The UF does not come with a web interface.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
