I usually used a web application to control or edit settings for data forwarder. Yesterday, the web access to the localhost:8000 is disabled showing page not found. I checked netstat -an | grep 8000, my terminal showed nothing, so checked again netstat -anltp | grep "LISTEN", and it only shows 8099 opened for plunk deamon, which seems to be a mgmt server, not web interface server.
What should I do to enable web interface again? tried to restart, but still not listening 8000
$SPLUNK_HOME/bin/splunk enable webserver then restart splunk, if this is a splunk universal forwarder then there is no web interface.
$SPLUNK_HOME/bin/splunk enable webserver then restart splunk, if this is a splunk universal forwarder then there is no web interface.
It can be any Splunk Enterprise install but not a Splunk Universal forwarder.
This command said me this is not permitted on this installation. I removed all splunk related folder and reinstall just a "splunk" instance. I believe this can also be a forwarder if I configure data forwarding. Thanks,
No, spunk is not found when I check via 'ps'. I found web.conf containing this stanza, so chained the value to 1 (true), restarted again. But still not working with web interface… One more question, do you think it will be working if i remove all spunk related folder, reinstall splunkforwarder? Thanks in advance!
Check if the splunkweb process is running, and if it is not check if any web.conf contains startwebserver=0
I always start using terminal because it is installed on the Ubuntu. It just restart successfully, showing 'done' message, but no 8000 port used - only mgmt port is.
Open a command prompt on the machine as administrator and start splunkd. It will tell you if there are issues with the ports.
c:\program files\splunk\bin\splunk.exe restart
Nope, its just splunkforwarder. even a spunk instance doesn't work with the 8000 port
Is that a Splunk Universal Forwarder? The UF does not come with a web interface.